Question
A global delivery company is modernizing its fleet management system. The company has several business units. Each business unit designs and maintains applications that are hosted in its own AWS account in separate application VPCs in the same AWS Region. Each business unit's applications are designed to get data from a central shared services VPC.
The company wants the network connectivity architecture to provide granular security controls. The architecture also must be able to scale as more business units consume data from the central shared services VPC in the future.
Which solution will meet these requirements in the MOST secure manner?
- A. Create a central transit gateway. Create a VPC attachment to each application VPC. Provide full mesh connectivity between all the VPCs by using the transit gateway.
- B. Create VPC peering connections between the central shared services VPC and each application VPC in each business unit's AWS account.
- C. Create VPC endpoint services powered by AWS PrivateLink in the central shared services VPC. Create VPC endpoints in each application VPC. Correct
- D. Create a central transit VPC with a VPN appliance from AWS Marketplace. Create a VPN attachment from each VPC to the transit VPC. Provide full mesh connectivity among all the VPCs.
Explanation
Option C is correct. An endpoint service powered by AWS PrivateLink exposes only the specific shared service (behind a Network Load Balancer) to consumers, and access is one-way: application VPCs can reach the service, but the shared services VPC and other application VPCs are not reachable through it. The provider controls exactly which AWS accounts or principals may create endpoints, can require acceptance of each connection request, and each interface endpoint is protected by security groups. New business units just create an interface endpoint in their own VPC, so the design scales without route table changes, and overlapping CIDRs are not a problem. A transit gateway full mesh (A) and a transit VPC full mesh (D) open network-wide connectivity between all VPCs, which is less secure, and VPC peering (B) gives full network reachability between VPCs and must be managed connection by connection.
