ANS-C01 Question 250
Single answerYour organization is hosting an internal billing application in a VPC within your AWS account. The application must be accessed securely by multiple client VPCs across various AWS accounts without exposing it to the public internet. You have been asked to design a solution that minimizes the need for managing VPNs or VPC peering connections. Which service configuration should you use to meet these requirements?
- A
Use AWS PrivateLink to create an interface VPC endpoint for the application and share it with client VPCs using Resource Access Manager (RAM).
- B
Enable VPC peering between your organization's VPC and each client VPC to allow private communication.
- C
Create a public-facing Application Load Balancer (ALB) for the application and restrict access using security groups.
- D
Use AWS Transit Gateway to connect your organization's VPC with all client VPCs.
Show answer and explanation
Correct answer: A
Explanation
AWS PrivateLink is designed specifically for securely sharing services across VPCs and accounts without exposing them to the public internet. By creating an interface VPC endpoint for the application and sharing it using AWS Resource Access Manager (RAM), you can meet the requirements for secure and scalable private connectivity with minimal management overhead. Other options either fail to meet the security requirements or introduce unnecessary complexity.
- A. Correct.
This is the correct answer. AWS PrivateLink allows you to securely expose your application to other VPCs as an interface endpoint without exposing it to the public internet. By using AWS Resource Access Manager (RAM), you can share the endpoint across AWS accounts.
- B. Incorrect.
This is incorrect. While VPC peering could enable private communication, it doesn't scale well for multiple client VPCs and requires significant management effort. Additionally, it doesn't align with the requirement to minimize management overhead.
- C. Incorrect.
This is incorrect. Exposing the application through a public-facing ALB violates the requirement to avoid public internet exposure. Security groups alone cannot mitigate this risk.
- D. Incorrect.
This is incorrect. While AWS Transit Gateway can connect multiple VPCs, it is designed for network connectivity and routing rather than securely exposing a single application. It also introduces additional complexity and cost.