Question

A financial services company must prove to auditors that all traffic between two applications running in separate AWS accounts never traverses the public internet and is encrypted in transit end-to-end. Application A (consumer) calls Application B (provider) over HTTPS. The provider exposes Application B through an AWS PrivateLink endpoint service backed by a Network Load Balancer. The security team wants the strongest defensible position that the payload remains encrypted along the entire path, including inside AWS. Which design satisfies both the private-path and end-to-end encryption requirements?

Accepted Answer

Configure the NLB with a TCP listener that passes TLS through to the backend targets, which terminate TLS with a certificate the consumer validates, keeping traffic private via the PrivateLink endpoint service.

Answer

Configure the NLB with a TLS listener that terminates TLS using an ACM certificate, then forwards plaintext to the backend targets, and rely on PrivateLink to keep traffic off the public internet.

Answer

Use VPC peering between the two accounts with security groups restricting access, and terminate TLS at an internal ALB in the provider VPC.

Answer

Expose Application B through a public-facing ALB with a WAF ACL and an ACM certificate, restricting source IPs to the consumer VPC NAT gateway addresses.