Question

A SaaS provider hosts a proprietary analytics service in its own AWS account and VPC. Hundreds of customers, each in separate AWS accounts and VPCs, must consume this service over private connectivity. Many customers use overlapping RFC 1918 CIDR ranges, and the provider wants to expose only the single analytics service (not its entire VPC) while avoiding any management of customer routing. Which connectivity design best meets these requirements?

Accepted Answer

Publish the analytics service behind a Network Load Balancer as an AWS PrivateLink endpoint service, and have each customer create an interface VPC endpoint to consume it.

Answer

Establish VPC peering connections between the provider VPC and each customer VPC, updating route tables on both sides.

Answer

Attach the provider VPC and all customer VPCs to a shared Transit Gateway and propagate routes to a common route table.

Answer

Create a Direct Connect gateway and associate the provider and customer VPCs to it for private service access.