AWS Certified Advanced Networking – Specialty (ANS-C01)Network DesignMedium
A global software company provides a Software-as-a-Service (SaaS) application to customers worldwide. Each customer has their own AWS account and requires private and secure access to the SaaS application, which runs in the vendor's AWS account. The solution must ensure that customer traffic does not traverse the public internet and that the SaaS application remains highly available and scalable. Which AWS networking service should the SaaS provider use to enable this private connectivity?
- AVPC Peering
- BAWS Client VPN
- CAWS Direct Connect
- DAWS PrivateLink
Show answer & explanationAnswer & explanation
Correct answer: D. AWS PrivateLink
AWS PrivateLink allows customers to privately connect their VPCs to services hosted in other AWS accounts (the SaaS provider's account) without using the public internet. The SaaS provider creates a VPC Endpoint Service, and each customer creates an Interface VPC Endpoint in their VPC to access the service, ensuring secure, private, and scalable access.
Why the other options are wrong
- A. VPC Peering can connect two VPCs, but it doesn't scale well for many customers, and it creates a transitive routing issue where customers cannot access other services through the peered VPC.
- B. Client VPN is for individual user access over the internet, not for private VPC-to-VPC service consumption across accounts.
- C. Direct Connect is for on-premises to AWS connectivity, not for inter-VPC connectivity between different AWS accounts for a SaaS offering.
AWS PrivateLink (VPC Endpoint Service)
A technology that enables you to privately connect your VPCs to AWS services, services hosted by other AWS accounts (VPC endpoint services), and supported AWS Marketplace partner services, without exposing your traffic to the public internet.
- Provides private connectivity between VPCs and services.
- Traffic does not traverse the public internet.
- SaaS providers create VPC Endpoint Services.
- Consumers create Interface VPC Endpoints to access the service.
- Scalable for many consumers and highly secure.
Memory trick: PrivateLink: Link customers privately to your SaaS cloud.