What is the most secure way to expose cross-account microservices with API Gateway?
A company is building an API-based application on AWS and is using a microservices architecture for the design. The company is using a multi-account AWS environment that includes a separate AWS account for each microservice development team. Each team hosts its microservice in its own VPC that contains Amazon EC2 instances behind a Network Load Balancer (NLB). A network engineer needs to use Amazon API Gateway in a shared services account to create an HTTP API to expose these microservices to external applications. The network engineer must ensure that access to the microservices can occur only over a private network. Additionally, the company must be able to control which entities from its internal network can connect to the microservices. In the future, the company will create more microservices that the company must be able to integrate with the application. What is the MOST secure solution that meets these requirements?
Community Votes
53% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests whether you know that HTTP API VPC links target Application Load Balancers, not NLBs, and that cross-account connectivity must be built with VPC endpoint services and PrivateLink interface endpoints.
The most secure approach is to use an API Gateway HTTP API with a VPC link to an ALB in a shared-services VPC, then terminate each microservice connection through PrivateLink VPC endpoints backed by VPC endpoint services. The community is split between A and D, but A is correct because HTTP API VPC links must target an ALB in the same account, and cross-account NLBs need PrivateLink rather than a direct VPC link.
Many candidates choose D because it seems like a direct private integration to each NLB. They miss that HTTP APIs do not support VPC links to NLBs and that a VPC link cannot cross accounts, so the ALB plus PrivateLink pattern in A is required.
Community Discussion (9 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Key Concepts
For Amazon API Gateway HTTP APIs, a VPC link provides a private integration between the API and resources inside a VPC. The target of an HTTP API VPC link must be an Application Load Balancer (ALB) or AWS Cloud Map, not a Network Load Balancer. To expose microservices in other accounts, the standard pattern is to create a VPC endpoint service in each microservice account, load it in the shared services account as an interface VPC endpoint, and place the endpoint's elastic network interface (ENI) IPs behind an ALB in the shared VPC.Why Option A is Correct
Option A creates an ALB in the shared services VPC and attaches the API Gateway VPC link to that ALB. Each microservice account contributes a VPC endpoint service backed by its NLB. The shared services account creates a PrivateLink interface endpoint for each endpoint service, which provides private IP addresses in the shared VPC. The ALB target group can use IP-based targets with those ENI IP addresses. This design keeps all traffic within the AWS private network, provides fine-grained access control through security groups on the interface endpoints and through endpoint services that can be configured to require endpoint acceptance, and scales easily because new microservices only require a new endpoint service and a new target in the ALB.Why Other Options Fail
- B also uses an ALB and VPC link, but it relies on a transit gateway to connect all VPCs and adds NLB IPs directly as ALB targets. This opens broader network paths between all VPCs, does not provide service-level authorization, and is less secure than PrivateLink.
- C uses HTTP-based integration without any VPC link, so traffic would not stay on the private network and API Gateway cannot reach private NLBs without a VPC link or public accessibility.
- D is the most common wrong answer. It tries to create a separate VPC link directly to each NLB. For HTTP APIs, VPC links are not supported with NLBs, and a VPC link in the shared account cannot integrate with resources in a different AWS account. The cross-account private integration requires the ALB plus VPC endpoint service pattern from Option A.
Community Perspective
The exam community is split, with many votes for D, but the correct answer is A. One commenter correctly notes that a private integration requires the load balancer, VPC link, and HTTP API to be in the same AWS account (https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-private.html). The AWS whitepaper “Best practices for API Gateway private integrations” describes the cross-account HTTP API pattern as using an ALB in the middle with PrivateLink endpoints, matching Option A.Official Reference
- https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-vpc-links.html
- https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-private.html
- https://docs.aws.amazon.com/whitepapers/latest/best-practices-api-gateway-private-apis-integration/http-api.html
Exam Strategy
For API Gateway private integration questions, first identify whether the API is HTTP or REST. HTTP API VPC links require an ALB or Cloud Map target, while REST APIs typically use an NLB. If the load balancer is in another account, think PrivateLink interface endpoints rather than a direct VPC link.
Related Analysis
Practice All ANS-C01 Questions
Access 137 questions with complete answers and detailed explanations.
View Full ANS-C01 Practice Test →