A healthcare startup hosts patient APIs on private subnets with no internet gateways, and partner clinics need secure private connectivity without traversing the public internet or managing VPNs. Traffic must stay on private networks with endpoint policies. Which private access design provides secure connectivity to the APIs?
Select an answer to reveal the explanation.
Short Explanation
You've got sensitive patient data, so you don't want it wandering the open internet. PrivateLink's like your own locked hallway for clinics, letting you share APIs through an interface endpoint with policies you control.
Full Explanation
Correct design works because interface endpoints expose the patient API as a PrivateLink service backed by load balancers in private subnets, letting clinic VPCs connect via local ENIs and private DNS with endpoint policies, so traffic never uses internet gateways and no VPN must be managed. VPC peering fails because it gives private IP routing between VPCs but operates on full CIDR tables with no service-level endpoint policy to restrict to one API and scales poorly across many clinics. Transit Gateway fails because it centralizes private inter-VPC routing without internet, yet still routes entire subnets and provides no PrivateLink endpoint policy or consumer-side service interface for least privilege. Gateway VPC endpoints fail because although they provide private policy-controlled access without internet or VPN, that type supports only S3 and DynamoDB via route tables and cannot front a custom private API service, which needs interface endpoints. Exam caveat is to map endpoint policy plus custom service wording to interface PrivateLink and not to peering, transit routing, or gateway endpoints. Practical check is to confirm DNS resolves to endpoint ENIs, policy allows only clinic principals to required API actions, and connectivity succeeds with internet gateways and VPNs absent.