ANS-C01 Question 164
Single answerYour company has a multi-account AWS setup where multiple applications in separate accounts need to securely access a shared service running in a central account. The shared service must not expose its endpoints to the public internet, and you want to minimize the number of VPC peering connections required. Which solution should you implement to meet these requirements?
- A
Use AWS PrivateLink to create an interface VPC endpoint for the shared service and share it with other accounts.
- B
Set up a Transit Gateway to connect all VPCs and route traffic to the shared service.
- C
Establish VPC peering connections between the central account and all other accounts' VPCs.
- D
Use a public-facing Application Load Balancer (ALB) to expose the shared service endpoint.
Show answer and explanation
Correct answer: A
Explanation
AWS PrivateLink is the optimal solution for securely sharing a service in a central account with multiple other accounts and VPCs. It allows direct, private communication via interface VPC endpoints, eliminating the need for public internet exposure or complex peering relationships. This makes it highly scalable and secure for multi-account environments.
- A. Correct.
Correct: AWS PrivateLink allows you to securely expose a service in one VPC to other accounts and VPCs using an interface VPC endpoint, without exposing the service to the public internet. This is the most scalable and secure solution for this use case.
- B. Incorrect.
Incorrect: While Transit Gateway can handle multi-VPC connectivity, it is not suitable for securely exposing a shared service within a single central VPC. This would require additional routing and does not minimize complexity as effectively as AWS PrivateLink.
- C. Incorrect.
Incorrect: VPC peering requires creating and managing individual peering connections for each VPC, which does not scale well in a multi-account environment. It also lacks centralized management compared to AWS PrivateLink.
- D. Incorrect.
Incorrect: A public-facing ALB would expose the shared service to the public internet, violating the requirement for secure communication without internet exposure.