A new courts case-management stack must call AWS APIs and shared internal services without traversing the public internet where policy forbids it. Which endpoint pattern should architects specify?
Select an answer to reveal the explanation.
Short Explanation
Interface endpoints are the private side door into AWS services—same APIs, no public sidewalk. Public IPs on databases and wide-open RDS are the opposite of a sealed courthouse network.
Full Explanation
When policy forbids courts case-management stacks from traversing the public internet to reach AWS APIs and shared internal services, architects should specify VPC interface endpoints (PrivateLink) for required AWS services and private integrations instead of public service endpoints. Attaching public IPs to every database and originating AWS API calls from those databases expands exposure and misplaces API clients. Disabling VPC endpoints and forcing every workload through open NAT to public endpoints exclusively violates the private-connectivity mandate. Exposing the court's RDS instance on 0.0.0.0/0 so partners can integrate without PrivateLink is a severe anti-pattern. Exam caveat: each interface endpoint needs security groups, private DNS, and cost awareness across AZs. Operational check: disable public egress for a pilot subnet, call the target AWS API via the interface endpoint, confirm traffic stays on private paths in VPC flow logs, and verify partner integrations use PrivateLink or equivalent private connectivity. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure.