Question
A SaaS company is launching a new product based in a cloud environment. The new product will be provided as an API and should not be exposed to the internet. Which of the following should the company create to best meet this requirement?
- A. A transit gateway that connects the API to the customer's VPC
- B. Firewall rules allowing access to the API endpoint from the customer's VPC
- C. A VPC peering connection from the API VPC to the customer's VPC
- D. A private service endpoint exposing the API endpoint to the customer's VPC Correct
Explanation
A private service endpoint (such as AWS PrivateLink or an Azure Private Endpoint) exposes only the API service into the customer's VPC over the provider's private network, so the API is never published to the internet and the two networks are not otherwise connected. VPC peering and a transit gateway connect whole networks, which gives broader access than needed and can be complicated by overlapping address ranges. Firewall rules only restrict who can reach an endpoint; they do not by themselves keep it off the internet.
