A consumer VPC must reach an internal data service in another VPC without the internet.
Limit the reachable service without exposing the provider's entire network.
Which authentication approach is most appropriate?
Publish an NLB through a PrivateLink endpoint service and connect consumers with an interface endpoint.
Detailed explanation
Lifecycle manages objects and provides no network path.
Lifecycle manages objects and provides no network path.
This expands routing and exposes more of the provider network than needed.
This expands routing and exposes more of the provider network than needed.
The attack surface and public reachability increase.
The attack surface and public reachability increase.
The service is privately shared at service granularity and consumer endpoints can be approved.
The service is privately shared at service granularity and consumer endpoints can be approved.
Check official documentation
Compare the following points with the official documentation.
AWS PrivateLink endpoint services、interface endpoints、NLBの公式説明を確認する。
What to confirm
VPC Peering・公開エンドポイントとサービス単位私設公開の違いを説明できる。
Key points
- PrivateLink
- Interface endpoint
- Endpoint service
- NLB
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Scope
Approve consumer accounts and endpoints and avoid unnecessary network reachability.
Name resolution
Use private DNS and certificate names that match the service clients expect.