Question

A financial services company operates a shared analytics service hosted in a central VPC. More than 40 application VPCs across multiple accounts must reach a single TCP endpoint (port 443) exposed by this analytics service. The security team requires that application VPCs must NOT be able to initiate connections to each other or to any other resource in the central VPC beyond the specific analytics endpoint. CIDR ranges across several application VPCs overlap. Which connectivity design best meets these requirements with the least ongoing administrative overhead?

Accepted Answer

Place the analytics service behind a Network Load Balancer, create a VPC endpoint service (AWS PrivateLink), and create interface VPC endpoints in each application VPC.

Answer

Attach all VPCs to a Transit Gateway and use a single route table that propagates every attachment so all VPCs can reach the analytics VPC.

Answer

Create VPC peering connections between the central VPC and each application VPC and add specific routes to the analytics subnet.

Answer

Deploy a Transit Gateway with the analytics VPC in a shared-services route table and enable appliance mode to inspect all inter-VPC traffic.