A company wants to use a third-party software-as-a-service (SaaS) application. The third-party SaaS application is consumed through several API…

AWS PrivateLink is the service designed for this exact use case. It enables private connectivity from a consumer VPC to a service hosted in a provider VPC without traversing the public internet. By creating an interface VPC endpoint, the company places an elastic network interface (ENI) in its own VPC that serves as a private entry point to the third-party service. This connection is unidirectional, meaning the service provider cannot initiate connections back into the company's VPC, which satisfies the security requirement. Attaching a security group to the endpoint ENI allows the company to enforce the principle of least privilege by controlling which resources within its VPC can access the service.

B: An AWS Site-to-Site VPN connection establishes an encrypted tunnel over the public internet, which violates the requirement that connectivity must not traverse the internet.

C: A VPC peering connection is bidirectional, allowing resources in both VPCs to communicate with each other. This violates the security mandate that no company resources be accessible from the outside.

D: This option incorrectly reverses the roles. The company is the service consumer and should create the interface endpoint, while the third-party SaaS provider is the service provider and should create the endpoint service.

1. AWS Documentation: AWS PrivateLink concepts. This document states

"AWS PrivateLink provides private connectivity between VPCs

AWS services

and your on-premises networks

without exposing your traffic to the public internet... The service consumer creates an interface VPC endpoint to connect to the endpoint service." It also clarifies

"Traffic to an endpoint service does not travel over the internet."

Source: AWS VPC User Guide

"AWS PrivateLink concepts".

2. AWS Documentation: Control access to your interface endpoint. This section explains how security groups are used with interface endpoints: "When you create an interface endpoint

you can associate security groups with the endpoint network interfaces... The security group rules control the traffic to and from the resources in your VPC that communicate with the service through the endpoint."

Source: AWS VPC User Guide

"Interface VPC endpoints (AWS PrivateLink)"

section "Control access to your interface endpoint".

3. AWS Documentation: What is VPC peering? This document highlights the bidirectional nature of peering: "A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses... Instances in either VPC can communicate with each other as if they are within the same network."

Source: AWS VPC User Guide

"VPC peering"

section "What is VPC peering?".

4. AWS Documentation: What is AWS Site-to-Site VPN? This document clarifies that VPN connections are established over the internet: "You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN (Site-to-Site VPN) connection... A Site-to-Site VPN connection offers two tunnels

with each tunnel using a unique public IP address."

Source: AWS Site-to-Site VPN User Guide

"What is AWS Site-to-Site VPN?".