A city wants an internal management API to be reachable only from i…

Question

A city wants an internal management API to be reachable only from inside its VPCs using Interface VPC endpoints and private DNS, with no public service endpoint exposure. Which approach best matches that requirement?

Accepted Answer

Use Interface VPC endpoints with private DNS so clients resolve and reach the API privately over AWS PrivateLink-style endpoint patterns instead of a public internet endpoint — Private endpoints are like an employees-only service window inside City Hall—Interface VPC endpoints plus private DNS keep the API on the inside track. Press-release public NLBs and laptop SSH tricks are the opposite of private-by-design.

Answer

Publish the API on a public Network Load Balancer open to 0.0.0.0/0 and distribute the URL in a press release

Answer

Host the API exclusively on the AWS account root user’s laptop using SSH port forwarding during business hours

Answer

Disable private DNS and require every developer to hard-code public regional endpoints in client apps

A city wants an internal management API to be reachable only from inside its VPCs using Interface VPC endpoints and private DNS, with no public service endpoint exposure. Which approach best matches that requirement?

Short Explanation

Full Explanation