A private application must call a partner API that the partner exposes only through AWS PrivateLink. The application must not use the public internet. Which endpoint type is the right one to create?
Select an answer to reveal the explanation.
Short Explanation
PrivateLink is a private socket to someone else's service, and the socket on your side is an interface endpoint. A gateway endpoint is the S3 and DynamoDB door, not a partner API. You cannot peer your VPC at a hostname and call it private.
Full Explanation
An interface VPC endpoint connects a subnet to an endpoint service, which is how a partner exposes an API with PrivateLink. The interface gets private addresses in your subnets, and traffic stays on the AWS network. Gateway endpoints are the route-table endpoints for S3 and DynamoDB; they do not attach to a partner endpoint service. Peering requires a VPC, not a public hostname. A NAT gateway without a route does not implement PrivateLink and would be an internet path if it had one. Caveat: the endpoint's security group must allow the application, and you need the partner's service name and permission to connect. Operational check: the interface endpoint should be available, and the application should resolve the endpoint DNS and succeed with no route to an internet gateway. You create the interface endpoint in the subnets where the application runs, using the service name the partner gave you. The endpoint needs a security group that allows the application's port. Private DNS, if the service supports it, lets the application keep the partner's hostname. A gateway endpoint cannot be created for that service name. Test from the private subnet with no internet route so you know the path is the endpoint.