Question

A financial services company runs a proprietary risk-scoring API on EC2 instances behind a Network Load Balancer in a producer VPC. Several partner organizations in separate AWS accounts must consume this API. Security requirements state that the traffic must never traverse the public internet, partners must not be able to reach any other resources in the producer VPC, and the producer must explicitly approve each partner before access is granted. Which solution meets all of these requirements?

Accepted Answer

Create an AWS PrivateLink endpoint service backed by the NLB, disable auto-acceptance of endpoint connections, and have each partner create an interface VPC endpoint to the service.

Answer

Create a VPC peering connection between the producer VPC and each partner VPC, and use security group references to restrict access to the NLB.

Answer

Publish the API through Amazon API Gateway with an AWS WAF web ACL and share the invoke URL with partners, restricting access with resource policies.

Answer

Attach all accounts to a Transit Gateway and use route tables to allow partner VPCs to reach only the NLB subnet in the producer VPC.