Question

A company runs an internal payments API on EC2 instances behind a Network Load Balancer in their 'provider' VPC (account A). Multiple partner teams in separate AWS accounts (each with overlapping CIDR ranges) must consume this API privately, without traversing the public internet and without exposing the entire provider VPC. The security team requires that consumers cannot initiate connections back into the provider VPC and that traffic never leaves the AWS network. Which solution meets these requirements with the least ongoing operational overhead?

Accepted Answer

Create an AWS PrivateLink VPC endpoint service backed by the Network Load Balancer in account A, and have each partner account create interface VPC endpoints to consume the service.

Answer

Establish VPC peering connections between the provider VPC and each partner VPC, then update route tables and security groups to allow access to the NLB.

Answer

Deploy an AWS Transit Gateway, attach all VPCs, and configure route tables to allow partner accounts to reach the NLB in the provider VPC.

Answer

Publish the payments API through a public Application Load Balancer protected by AWS WAF and restrict access using security group references to partner account IPs.