Question

A financial services company runs a shared analytics service in a provider VPC. Dozens of consumer accounts, several with CIDR ranges that overlap with the provider VPC and with each other, must reach this single TCP-based service on port 8443. The provider must not manage routing for consumer networks, and consumers must not gain access to any other resources in the provider VPC. Traffic must stay on the AWS private network. Which connectivity design best meets these requirements?

Accepted Answer

Create an AWS PrivateLink endpoint service backed by a Network Load Balancer in the provider VPC, and have each consumer create an interface VPC endpoint to the service.

Answer

Attach all provider and consumer VPCs to a Transit Gateway and use route table segmentation to expose only the analytics subnet.

Answer

Establish VPC peering connections between the provider VPC and each consumer VPC, adding specific routes only for the analytics service subnet.

Answer

Deploy a Direct Connect gateway with a transit VIF so consumers reach the analytics service over a private connection.