A biotech firm hosts genomic APIs on private EC2 subnets that partner labs must reach without traversing the internet, with no inbound VPC changes per partner and private DNS for AWS services. Partners use separate AWS accounts and require scalable private connectivity. Which secure private access design meets these isolation needs?
Select an answer to reveal the explanation.
Short Explanation
You’re adding private driveways without opening highways. PrivateLink keeps traffic off the internet, like tunnels connecting only invited partners to your service.
Full Explanation
AWS PrivateLink via VPC endpoint services lets consumer VPCs create interface endpoints to provider NLB-backed services with unidirectional, private connectivity and no peering or public IPs, while interface and gateway VPC endpoints keep AWS service traffic private with PrivateDNS. Internet ALB plus VPN fails by concept because traffic traverses public endpoints, requires per-partner network management, and expands exposure. VPC peering per partner fails by concept because it creates full mesh routing, overlapping CIDR risk, and transitive trust complexity that does not scale. Public API Gateway with keys fails by concept because endpoints remain internet-accessible and API keys are not authentication or network isolation. Exam caveat: PrivateLink for cross-account private SaaS, VPC endpoints for private AWS service access. Practical check: allow principal ARNs, enable endpoint acceptance, and verify PrivateDNS resolution.