A municipal API in a shared networking account must privately reach Network Load Balancer targets that live in a spoke VPC application account without opening the spoke to broad network routing. Which pattern best fits?
Select an answer to reveal the explanation.
Short Explanation
PrivateLink is the private storefront window: the spoke publishes a service, the networking account shops through an endpoint, and you skip dumping whole CIDR maps into each other. Full-mesh peering just to reach one API is overkill with extra blast radius.
Full Explanation
AWS PrivateLink (VPC endpoint services) lets a provider account expose an NLB-fronted application privately to consumer accounts via interface endpoints, without requiring transitive VPC CIDR routing between networks. That fits a shared networking account consuming a spoke municipal API securely. Full-mesh peering expands reachability beyond the service, public NLBs violate private integration goals, and relocating workloads solely to avoid PrivateLink is unnecessary when the pattern is in-scope.