A bank hosts a payments API on private ALBs in a service VPC and must let two partner VPCs call it without internet, public IPs, or transitive routing. Compliance requires private DNS names and a provider-controlled list of which partner accounts may connect. Which private connectivity control enables secure partner access to the API?

AWS PrivateLink publishes the payments service through an endpoint service backed by a Network Load Balancer (with the ALB registered as its target), while consumers create interface endpoints in their own VPCs that resolve via private DNS, keeping traffic on the AWS network with no peering, no internet gateway, and allowed principals on the endpoint service (with connection acceptance) limiting which partner accounts can connect, since endpoint policies are not available for customer-created endpoint services. VPC peering creates transitive-style routable connectivity and broad network adjacency that violates the no transitive routing and least exposure requirement. An internet-facing load balancer exposes the API publicly and depends on IP allowlisting rather than private connectivity, failing compliance. Client VPN provides user remote access tunnels rather than scalable VPC-to-service connectivity and adds client management overhead. For the exam remember PrivateLink for private SaaS-style service exposure, and in practice verify endpoint service allowlisting, and private DNS name verification.