ANS-C01 Question 358
Select 3Your company has deployed a custom service in a VPC on AWS, and now you need to provide secure access to the service for external clients from another AWS account. The requirement is to ensure that traffic does not traverse the public internet and must remain private. Which of the following approaches would meet this requirement?
- A
Use AWS PrivateLink to expose the service as an endpoint in the other account's VPC.
- B
Configure VPC peering between your VPC and the external client's VPC.
- C
Expose the service via an Elastic Load Balancer and allow access using a public IP.
- D
Use an internet gateway in your VPC and route traffic through it to the custom service.
- E
Set up a Transit Gateway and share the service over the Transit Gateway connection.
Show answer and explanation
Correct answers: A, B, E
Explanation
To meet the requirement of secure, private access to a service across AWS accounts without traversing the public internet, AWS PrivateLink, VPC peering, and Transit Gateway are appropriate solutions. PrivateLink provides the most direct and secure method for exposing a service as an endpoint in another account's VPC. VPC peering allows direct private connectivity, though it lacks transitive routing. A Transit Gateway enables scalable and private inter-VPC communication, suitable for multi-VPC or multi-account setups. Public-facing solutions like internet gateways or public Elastic Load Balancers do not meet the requirement for private communication.
- A. Correct.
AWS PrivateLink enables secure and private access to services across VPCs and accounts without exposing the service to the public internet. This meets the requirement perfectly.
- B. Correct.
VPC peering allows private communication between VPCs without traversing the public internet. This is a valid solution when the VPCs are in the same region and do not require transitive connectivity.
- C. Incorrect.
Exposing the service via a public Elastic Load Balancer would send traffic over the public internet, which violates the requirement to keep traffic private.
- D. Incorrect.
Using an internet gateway routes traffic through the public internet, which does not meet the requirement for private communication.
- E. Correct.
A Transit Gateway can connect multiple VPCs securely and privately, including VPCs across accounts, making it a valid option for this scenario.