A company wants to expose an internal application, running behind a Network Load Balancer in its own VPC, to several customer VPCs in other AWS accounts — without those customers being able to reach any other resource in the company's VPC, and without requiring VPC peering or CIDR coordination between the accounts. Which AWS PrivateLink feature fits this requirement, and what is a defining property of it?
- A VPC peering connection combined with a highly restrictive route table, since peering is the only way to connect resources across AWS accounts privately
- A VPC endpoint service (an AWS PrivateLink-powered service) fronted by the Network Load Balancer; consumer accounts connect via an interface VPC endpoint, and access is limited to only the exposed service, not general network reachability into the provider's VPC, with no CIDR overlap concerns between the two sides
- A Transit Gateway attachment shared with the customer accounts via AWS Resource Access Manager, since Transit Gateway is required for any cross-account AWS PrivateLink connectivity
- A gateway VPC endpoint, since gateway endpoints are the mechanism used to expose custom applications to other AWS accounts
Why B? And why not the others?
Correct answer: B. A VPC endpoint service (an AWS PrivateLink-powered service) fronted by the Network Load Balancer; consumer accounts connect via an interface VPC endpoint, and access is limited to only the exposed service, not general network reachability into the provider's VPC, with no CIDR overlap concerns between the two sides
AWS PrivateLink lets a provider create a VPC endpoint service fronted by a Network Load Balancer, then grant specific AWS principals — including other accounts — permission to connect via an interface VPC endpoint; the consumer only gets access to the specific service exposed through that load balancer, not general L3 reachability into the provider's VPC, and because traffic is proxied through elastic network interfaces rather than routed at the CIDR level, the two VPCs never need non-overlapping or coordinated address ranges. Option A is wrong because VPC peering grants broad network-level reachability between the peered CIDR ranges (subject to route tables and security groups), which is exactly the exposure the company wants to avoid, and it also requires non-overlapping CIDRs, unlike PrivateLink. Option C is wrong because Transit Gateway is a separate routing hub service and is not a prerequisite for AWS PrivateLink endpoint services, which work standalone across accounts. Option D is wrong because gateway endpoints exist only for a small set of AWS-managed services like S3 and DynamoDB and cannot be used to expose a customer's own custom application; that provider-side capability is specifically what endpoint services (interface endpoints) enable.
Source: AWS PrivateLink docs: Share your services through AWS PrivateLink