Question

A company runs a data analytics platform in a dedicated 'analytics' account in the us-east-1 Region. A newly acquired subsidiary operates a customer-facing application in a separate 'subsidiary' account in the eu-west-1 Region. Both accounts belong to the same AWS Organization. The analytics team needs the subsidiary application to send periodic batch uploads (a few gigabytes daily) to an internal service running behind an internal Network Load Balancer in the analytics VPC. Both VPCs use overlapping CIDR ranges (10.0.0.0/16). The solution must be private (no traffic over the public internet), minimize ongoing operational overhead, and avoid re-addressing either VPC. Which approach best meets these requirements?

Accepted Answer

Create a VPC endpoint service (AWS PrivateLink) fronting the NLB in the analytics account and create an interface VPC endpoint in the subsidiary VPC that connects to it across accounts and Regions.

Answer

Establish an inter-Region VPC peering connection between the two VPCs and add routes so the subsidiary can reach the NLB directly.

Answer

Attach both VPCs to a Transit Gateway shared via AWS RAM and configure inter-Region Transit Gateway peering to route traffic between them.

Answer

Re-address one of the VPCs to a non-overlapping CIDR, then use VPC peering with static routes to connect the two VPCs privately.