A SaaS provider has 60 workload VPCs across three business units plus on-premises data centers, must share a central logging and license service without transitive internet routing, and needs private connectivity that scales without managing hundreds of peering links. Which multi-VPC hybrid connectivity design provides scalable private service sharing?

Transit Gateway creates a scalable hub with segmented route tables linking the 60 workload VPCs and on-premises through VPN or Direct Connect, avoiding an unwieldy mesh of peering links. PrivateLink exposes only the central logging and licensing services as interface endpoints, so workloads use private DNS without learning the provider’s CIDRs; this combines hybrid routing with private, isolated service sharing. Routing to public secured endpoints through NAT fails the private-connectivity requirement: even with TLS and Transit Gateway for internal routes, service traffic traverses the public internet and relies on public DNS. Advertising a central services VPC’s subnet CIDRs through Transit Gateway makes its network reachable and couples consumers to those IP ranges, rather than providing PrivateLink’s one-way access and tolerance for overlapping CIDRs. Interface endpoints in isolated workload VPCs do not, by themselves, create controlled VPC-to-VPC connectivity across the business units; Direct Connect supplies on-premises connectivity, not that inter-VPC fabric. Exam caveat: distinguish PrivateLink service consumption from Transit Gateway network routing; scalable private sharing points to endpoints, not CIDR propagation. In practice, verify Transit Gateway attachments and route tables, resolve the private endpoint DNS name from a workload, and trace the path to confirm service and hybrid traffic stay private.