AWS Certified Advanced Networking – Specialty (ANS-C01)Network DesignHard
A global software company needs to provide private and secure access to its SaaS application, hosted in an AWS VPC, for its enterprise customers. Each customer has their own AWS account and VPCs. The solution must ensure that traffic between customer VPCs and the SaaS application VPC does not traverse the public internet and simplifies network configuration for customers. What is the most appropriate service to achieve this?
- AAWS Site-to-Site VPN connections from each customer VPC to the SaaS VPC.
- BVPC Peering connections between the SaaS VPC and each customer VPC.
- CAWS PrivateLink with a VPC endpoint service.
- DAWS Transit Gateway with shared routing tables.
Show answer & explanationAnswer & explanation
Correct answer: C. AWS PrivateLink with a VPC endpoint service.
AWS PrivateLink allows you to expose your service (SaaS application) privately to other VPCs, even in different accounts, without traversing the public internet. Customers create a VPC endpoint in their VPC, which establishes a private connection to your VPC endpoint service. This simplifies customer configuration and enhances security.
Why the other options are wrong
- A. Site-to-Site VPN is for hybrid connectivity to on-premises, not for private VPC-to-VPC service access within AWS, and would be complex to manage for many customers.
- B. VPC Peering requires a direct connection for each customer, leading to a complex mesh network as the number of customers grows, and it doesn't offer service-level abstraction.
- D. Transit Gateway connects multiple VPCs, but it's a network-level hub-and-spoke. PrivateLink is specifically designed for exposing services privately, offering better abstraction and simpler customer configuration for SaaS scenarios.
AWS PrivateLink for SaaS
AWS PrivateLink enables you to provide your services as private endpoints in other AWS VPCs, allowing secure, private connectivity without traversing the public internet.
- Private connectivity to services (SaaS)
- Traffic does not traverse the public internet
- Simplified network configuration for consumers
- Provider creates an Endpoint Service, consumer creates a VPC Endpoint
Memory trick: PrivateLink is your private tunnel to SaaS heaven.