Question
A software-as-a-service (SaaS) provider hosts its solution on Amazon EC2 instances within a VPC in the AWS Cloud. All of the provider's customers also have their environments in the AWS Cloud.
A recent design meeting revealed that the customers have IP address overlap with the provider's AWS deployment. The customers have stated that they will not share their internal IP addresses and that they do not want to connect to the provider's SaaS service over the internet.
Which combination of steps is part of a solution that meets these requirements? (Choose two.)
- A. Deploy the SaaS service endpoint behind a Network Load Balancer. Correct
- B. Configure an endpoint service, and grant the customers permission to create a connection to the endpoint service. Correct
- C. Deploy the SaaS service endpoint behind an Application Load Balancer.
- D. Configure a VPC peering connection to the customer VPCs. Route traffic through NAT gateways.
- E. Deploy an AWS Transit Gateway, and connect the SaaS VPC to it. Share the transit gateway with the customers. Configure routing on the transit gateway.
Explanation
AWS PrivateLink meets all the requirements: customers reach the SaaS service through an interface VPC endpoint in their own VPC, traffic stays on the AWS network, and because traffic is not routed between the VPCs, overlapping CIDR ranges do not matter and customers never expose their internal IP addresses. An endpoint service must be fronted by a Network Load Balancer (option A), so the provider places the SaaS endpoint behind an NLB, creates an endpoint service for it and grants the customers' accounts permission to connect (option B). An Application Load Balancer cannot be used directly as an endpoint service. VPC peering and transit gateway attachments require routable, non-overlapping CIDRs and expose the customers' address space, so options D and E do not meet the requirements.
