ANS-C01 Question 248
Select 2Your company has a VPC in AWS that hosts a business-critical application running on an Amazon ECS service. The application must securely access data from a partner's SaaS offering hosted in another AWS account. The partner provides their service through an AWS PrivateLink interface endpoint. What steps should you take to enable this secure connectivity?
- A
Create a VPC Endpoint Service in your account and share it with the partner's account.
- B
Create an Interface VPC Endpoint in your VPC and specify the partner's service name during setup.
- C
Ensure that your VPC has a route to the service through the associated NAT Gateway.
- D
Update the security group associated with the interface endpoint to allow traffic from your application.
- E
Establish a peering connection between your VPC and the partner's VPC.
Show answer and explanation
Correct answers: B, D
Explanation
To securely connect to a partner's SaaS offering using AWS PrivateLink, you need to create an Interface VPC Endpoint in your VPC and provide the partner's service name. This setup establishes private connectivity over the AWS network, eliminating the need for NAT Gateways or VPC peering. Additionally, the security group for the endpoint must allow traffic from your application to ensure successful communication.
- A. Incorrect.
Incorrect. A VPC Endpoint Service is used to expose your service to other accounts. Since you are consuming the partner's service, this step is not applicable.
- B. Correct.
Correct. To consume a service hosted over AWS PrivateLink, you need to create an Interface VPC Endpoint in your VPC and specify the service name of the provider.
- C. Incorrect.
Incorrect. PrivateLink traffic does not require a NAT Gateway. It uses private IP connectivity within the AWS network.
- D. Correct.
Correct. The security group associated with the interface endpoint must be configured to allow traffic from your application to ensure proper connectivity.
- E. Incorrect.
Incorrect. While a VPC peering connection allows private communication between VPCs, PrivateLink does not require peering connections and is the recommended approach for SaaS integrations.