A municipal API must be reachable only from a partner VPC and must not be exposed on the public internet. Which pattern should the architect use?
Select an answer to reveal the explanation.
Short Explanation
PrivateLink is the private service hatch between buildings—partners walk through without stepping onto the public street. Use interface endpoints / endpoint services so only the partner VPC reaches the API. Internet NLBs, 0.0.0.0/0, or laptop hosting are not private partner access.
Full Explanation
A municipal API that must be reachable only from a partner VPC—and must not be exposed on the public internet—should be published through AWS PrivateLink using an interface VPC endpoint service so the partner consumes the API privately. PrivateLink brings the service into the partner’s VPC as elastic network interfaces with private IPs, avoiding internet gateways and public URLs while still allowing controlled cross-account/VPC consumption typical of inter-agency integrations.
Placing an internet-facing Network Load Balancer in front of the API and distributing the URL on social media fails because it deliberately publishes a public entry point contrary to the private-only requirement. Opening the API security group to 0.0.0.0/0 and depending on hostname secrecy fails conceptually: DNS names leak, scanners probe IP space, and obscurity is not authorization. Hosting the API only on a developer laptop on residential Wi-Fi during business hours fails because it is neither highly available nor a governed private connectivity pattern for partner agencies.
Exam caveat: PrivateLink still requires endpoint service policies, security groups on the provider and consumer ENIs, and health of the backing NLB/targets—private connectivity does not imply unrestricted trust. Operational check: create the endpoint service, accept the partner’s endpoint connection, confirm the partner resolves and reaches private IPs only, verify the API is not reachable via a public ALB/NLB DNS name, and document connection approval owners for the city’s integration board.