A company is migrating a new application from an on-premises data center to a new VPC in the AWS Cloud. The company has multiple AWS accounts and…

AWS PrivateLink is the ideal solution for this scenario. It allows you to expose a specific application in your VPC as a private endpoint service. Other VPCs, even in different AWS accounts, can then create an interface endpoint to access this service securely and privately, without traffic traversing the public internet. The key advantage is the ability to define an endpoint policy, which allows the service provider to explicitly grant permissions to specific AWS principals (accounts, IAM users, or roles). This directly addresses the requirement for "fine-grained access control" for the application, ensuring only authorized resources can connect.

A. VPC peering connects entire VPCs, not just a specific application. It lacks fine-grained, service-level access control and becomes unmanageable at scale due to its non-transitive, mesh-like nature.

B. A transit gateway provides network-level connectivity between many VPCs. It controls which VPCs can route traffic to each other but does not offer fine-grained access control to a specific application within a VPC.

D. Using a public Application Load Balancer exposes the application to the internet, which is contrary to the implied need for private connectivity between internal VPCs and introduces unnecessary security risks.

1. AWS PrivateLink Documentation - Endpoint services: "With AWS PrivateLink

you can create your own VPC endpoint service

powered by Network Load Balancer

and provide it to other AWS customers... As the service provider

you have control over which principals (AWS accounts

IAM users

and IAM roles) can access your service." (AWS Documentation

VPC User Guide

"VPC endpoint services (AWS PrivateLink)").

2. AWS PrivateLink Documentation - Access Control: "To control which principals can access your endpoint service

you can add permissions to your endpoint service. Permissions are granted to principals by their Amazon Resource Name (ARN)." (AWS Documentation

VPC User Guide

"Control access to your endpoint service").

3. AWS Transit Gateway Documentation - Overview: "An AWS Transit Gateway is a network transit hub that you can use to interconnect your virtual private clouds (VPCs) and on-premises networks." This highlights its function as a network router

not a service-level access control mechanism. (AWS Documentation

AWS Transit Gateway User Guide

"What is a transit gateway?").

4. AWS VPC Peering Documentation - Limitations: "You cannot create a VPC peering connection between VPCs with matching or overlapping IPv4 CIDR blocks." The scenario states VPCs "share many subnets

" making peering a potentially non-viable option. (AWS Documentation

VPC Peering Guide

"VPC peering basics and limitations").