A logistics group runs 40 workload accounts with a shared payments VPC and an on-premises data center over Direct Connect. Workloads need centralized routing, overlapping IP isolation for acquisitions, and private access to payments without traversing the internet. Which connectivity design provides scalable hybrid and multi-account VPC integration?
Select an answer to reveal the explanation.
Short Explanation
You've got sprawl plus an acquisition with clashing IPs, so you need a hub that scales. Transit Gateway acts like a central airport hub while PrivateLink gives you a private side-door to shared services.
Full Explanation
Transit Gateway provides centralized, scalable routing across many VPCs and hybrid connections via Direct Connect gateway, avoiding the operational complexity of a full VPC peering mesh and while isolated route tables keep acquisitions separated (Transit Gateway itself cannot route between overlapping CIDRs, so overlapping address space is handled by exposing services through PrivateLink). AWS PrivateLink exposes the shared payments service through interface endpoints with private IPs inside consumer VPCs, so traffic never traverses the internet and provider and consumer networks remain isolated. A full mesh of VPC peering fails by concept because peering is non-transitive, does not scale operationally, and cannot resolve overlapping IPs or provide transitive hybrid routing. Using internet gateways with public ALBs fails by concept because it exposes internal services to the internet and violates the private connectivity requirement. Using NAT gateways with centralized egress fails by concept because NAT provides outbound internet access only and does not enable private inter-VPC or hybrid service consumption.