Q33 — AWS SAA-C03 Ch.13

Question 33 of 100 | ← Chapter 13

Q933. A company has a multi-tier web application.The application's internal service components are deployed on Amazon EC2 instances.The internal service components need to access third-party software as a service (SaaS) APIs that are hosted on AWS.The company needs to provide secure and private connectivity from the application's internal services to the third-party SaaS application. The company needs to ensure that there is minimal public internet exposure.Which solution will meet these requirements?

Correct Answer: D. Use AWS PrivateLink to create a private connection between the application's VPC and the third-party SaaS provider.

Explanation

The best solution to meet the company's requirements is:D. Use AWS PrivateLink to create a private connection between the application's VPC and the third-party SaaS provider.Here's why:Private Connectivity: AWS PrivateLink allows you to establish a private connection between your VPC and supported AWS services (including many SaaS providers) without exposing your resources to the public internet.Secure Access: PrivateLink uses AWS's private network infrastructure, ensuring secure and reliable connectivity between your application and the third-party SaaS application.Minimal Public Exposure: Traffic remains within the AWS network, minimizing public internet exposure and enhancing security.No Public IP Addresses: PrivateLink eliminates the need for public IP addresses for your internal service components, further enhancing security.Why other options are less suitable:A. Implement an AWS Site-to-Site VPN to establish a secure connection with the third-party SaaS provider. While VPNs can provide secure connectivity, they require configuring and managing VPN gateways and tunnels, adding complexity and potential overhead.B. Deploy AWS Transit Gateway to manage and route traffic between the application's VPC and the third-party SaaS provider. Transit Gateway is primarily for connecting multiple VPCs, not for establishing private connections to specific services.C. Configure AWS PrivateLink to allow only outbound traffic from the VPC without enabling the third- party SaaS provider to establish a return path to the network. This approach doesn't provide a complete private connection. The third-party SaaS provider might still need to access resources within your VPC, requiring additional configuration.In summary:AWS PrivateLink (option D) provides the most secure and efficient solution for establishing a private connection to the third-party SaaS application, minimizing public internet exposure and simplifying network management.