Question

A company runs a centralized fraud-detection microservice in a shared-services AWS account. Dozens of application accounts across multiple VPCs (some with overlapping CIDR ranges) need to consume this service over private connectivity. The security team requires that only the specific service be reachable — not the entire shared-services VPC — and that consumers cannot initiate connections back into the provider VPC. Which approach best meets these requirements with the least ongoing operational overhead?

Accepted Answer

Publish the fraud-detection service behind a Network Load Balancer as an AWS PrivateLink endpoint service, and have each consumer account create interface VPC endpoints to it.

Answer

Attach all VPCs to a Transit Gateway and use route tables to expose only the subnet hosting the fraud-detection service to consumer accounts.

Answer

Create VPC peering connections between the shared-services VPC and each application VPC, then restrict traffic to the service using security groups.

Answer

Deploy the fraud-detection service behind an internet-facing Application Load Balancer and restrict access using IP allow-lists and WAF rules per consumer account.