ANS-C01 Question 163
Single answerYour organization operates multiple VPCs across different AWS accounts for various teams. Team A in Account 1 needs to securely consume a service hosted in Team B's VPC in Account 2. The service is internal, should not be exposed to the public internet, and does not require full network connectivity between the VPCs. Which solution should you use to meet these requirements?
- A
Set up a VPC peering connection between the two VPCs and configure routing tables accordingly.
- B
Use AWS Transit Gateway to connect the two VPCs for secure communication.
- C
Implement AWS PrivateLink to expose the service from Team B's VPC and allow Team A to consume it.
- D
Create a Site-to-Site VPN connection between the two VPCs for secure communication.
Show answer and explanation
Correct answer: C
Explanation
AWS PrivateLink is specifically designed for scenarios where a service in one VPC needs to be securely consumed by another VPC without requiring full network connectivity. It simplifies the process of exposing services internally while ensuring security and isolation, making it the best choice for the given use case.
- A. Incorrect.
VPC peering provides full network connectivity between two VPCs, which is not required in this scenario. Additionally, managing private service exposure with VPC peering would require complex configurations.
- B. Incorrect.
AWS Transit Gateway is designed for scalable, hub-and-spoke connectivity between multiple VPCs or on-premises networks. While it could connect the VPCs, it is overkill for this specific use case where only a service needs to be consumed securely.
- C. Correct.
AWS PrivateLink is the optimal solution for this scenario because it allows Team B to securely expose their service as an endpoint within Team A's VPC without full network connectivity. This ensures the service remains internal and isolated.
- D. Incorrect.
Site-to-Site VPN is used for secure communication between on-premises networks and AWS or between AWS regions. It is not meant for secure service exposure between VPCs.