A municipal API in a shared networking account must privately reach Network Load Balancer targets that live in a spoke VPC application account without opening the spoke to broad network routing. Which pattern best fits?
Select an answer to reveal the explanation.
Short Explanation
PrivateLink is the private storefront window: the spoke publishes a service, the networking account shops through an endpoint, and you skip dumping whole CIDR maps into each other. Full-mesh peering just to reach one API is overkill with extra blast radius.
Full Explanation
When a municipal API in a shared networking account must privately reach Network Load Balancer targets in a spoke application account without opening broad network routing into that spoke, AWS PrivateLink is the fitting pattern. The application account publishes the NLB-backed service as a VPC endpoint service; the networking account consumes it through interface VPC endpoints. Traffic stays on the Amazon network, consumers do not need the full spoke CIDR routed into their tables, and the provider exposes only the service—not the entire VPC—matching least-exposure multi-account networking.
Peering every networking and application VPC into a full mesh with mutual CIDR exchange creates broad routability the stem asked to avoid and scales poorly. Publishing the NLB on the internet with a public IP and weak security groups abandons private consumption entirely. Copying the application into the networking account’s VPC merely to avoid PrivateLink collapses account boundaries and operational ownership that multi-account designs exist to preserve.
Exam caveat: PrivateLink is preferred over peering when the goal is service exposure without CIDR sharing; do not confuse Gateway Load Balancer inspection patterns with endpoint-service PrivateLink for NLB-fronted apps. Operational check: create the endpoint service on the provider NLB, accept the consumer endpoint connection, resolve the endpoint DNS from the networking account, confirm security groups allow only required ports, and verify the spoke’s other subnets remain unreachable from the consumer without TGW/peering routes.