Question

A financial services company runs an internal fraud-scoring API on an Amazon EC2 fleet behind a Network Load Balancer in a provider VPC. They expose it to multiple consumer VPCs (belonging to different internal business units) through an AWS PrivateLink endpoint service. The security team requires that only specific approved consumer applications can send traffic to the service, and that the provider must enforce which source addresses within a consumer VPC can reach the endpoint at the network layer. Which approach correctly enforces this control on the traffic entering the interface endpoint from consumers?

Accepted Answer

Attach a security group to the interface VPC endpoint in each consumer VPC that permits inbound traffic only from the approved application security groups or CIDR ranges within that consumer VPC.

Answer

Configure a security group on the provider's Network Load Balancer that references the consumer VPC endpoint's private IP addresses to allow only approved sources.

Answer

Add an endpoint policy to the interface endpoint that specifies IAM principals allowed to invoke the fraud-scoring API.

Answer

Create a network ACL on the provider VPC subnets that allows inbound traffic only from the consumer VPC endpoint elastic network interface IPs.