Question

A financial services company runs a market-data distribution platform across a multi-account AWS Organization. A publisher application in a shared 'data-services' account must stream a real-time price feed to dozens of subscriber applications, each running in its own consumer account across three VPCs per account. Subscribers must not be able to initiate connections back to the publisher or reach each other, and the publisher must not manage IP allow-lists as consumer accounts are added or removed. The team wants the lowest ongoing operational overhead for onboarding new consumer accounts. Which architecture best meets these requirements?

Accepted Answer

Expose the publisher behind a Network Load Balancer and create a VPC endpoint service (AWS PrivateLink); each consumer account creates an interface VPC endpoint to consume the feed, with the endpoint service configured to auto-accept approved principals.

Answer

Attach all publisher and consumer VPCs to a shared Transit Gateway via AWS RAM and propagate a single route table so every account can route to the publisher subnet.

Answer

Establish full-mesh VPC peering between the publisher VPC and every consumer VPC, updating route tables and security groups as accounts are added.

Answer

Place the publisher in a central VPC shared to consumer accounts via VPC sharing (RAM) so all subscribers launch resources into the shared subnets alongside the publisher.