A municipal API must be reachable only from a partner VPC and must…

Question

A municipal API must be reachable only from a partner VPC and must not be exposed on the public internet. Which pattern should the architect use?

Accepted Answer

Expose the API through AWS PrivateLink (interface VPC endpoints / endpoint services) so the partner consumes it privately. — PrivateLink is the private service hatch between buildings—partners walk through without stepping onto the public street. Use interface endpoints / endpoint services so only the partner VPC reaches the API. Internet NLBs, 0.0.0.0/0, or laptop hosting are not private partner access.

Answer

Place an internet-facing Network Load Balancer in front of the API and distribute the URL on social media.

Answer

Open the API security group to 0.0.0.0/0 and depend on clients to keep the hostname secret.

Answer

Host the API only on a developer laptop connected by residential Wi-Fi during business hours.

A municipal API must be reachable only from a partner VPC and must not be exposed on the public internet. Which pattern should the architect use?

Short Explanation

Full Explanation