Question

A financial services company exposes an internal payment API to hundreds of partner VPCs using AWS PrivateLink. The endpoint service is backed by a Network Load Balancer. Partners report intermittent connection failures that correlate with times when the company performs maintenance in one Availability Zone. The company's VPC spans three AZs (us-east-1a, 1b, 1c), but the NLB and endpoint service are configured with subnets only in us-east-1a and us-east-1b. Partner interface endpoints are created in all three AZs. What is the most likely cause of the failures and the correct remediation?

Accepted Answer

Consumer interface endpoints in us-east-1c have no corresponding provider AZ, so traffic to that endpoint ENI has no path; enable the endpoint service in us-east-1c by adding an NLB subnet there and enabling cross-zone load balancing is optional but recommended.

Answer

PrivateLink requires VPC peering between provider and consumer to route across AZs; add peering connections and update route tables to reach the NLB during maintenance.

Answer

The NLB must terminate TLS for PrivateLink to preserve availability; install an ACM certificate on the NLB and switch the listener to TLS so failover works across AZs.

Answer

Interface endpoints do not support multiple AZs, so partners must consolidate all endpoints into a single AZ that matches the provider; delete the us-east-1c endpoints.