Question

A SaaS provider hosts an internal microservice behind a Network Load Balancer in its own VPC. Dozens of customer VPCs, some with overlapping CIDR ranges, need to consume this service privately without traversing the public internet. The provider wants to avoid managing route tables in each consumer VPC and does not want consumers to reach any other resources in the provider's VPC. Which approach best meets these requirements?

Accepted Answer

Create an AWS PrivateLink VPC endpoint service backed by the NLB, and have each consumer create an interface VPC endpoint to it

Answer

Establish VPC peering connections between the provider VPC and every consumer VPC, updating route tables on both sides

Answer

Attach all VPCs to a Transit Gateway and configure route tables to allow consumers to reach the provider's NLB

Answer

Publish the service through a public Application Load Balancer and restrict access using security group rules referencing consumer CIDRs