What is the most secure way to expose cross-account microservices with API Gateway?

ANS-C01 By islever Editorial Last updated

Short answer

A Create an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALB. Create a VPC endpoint service in each microservice account. Create an AWS PrivateLink endpoint for those services in the shared services account. Add the elastic network interface IP addresses of the VPC endpoint as targets for the target group of the ALB.

Question

A company is building an API-based application on AWS and is using a microservices architecture for the design. The company is using a multi-account AWS environment that includes a separate AWS account for each microservice development team. Each team hosts its microservice in its own VPC that contains Amazon EC2 instances behind a Network Load Balancer (NLB). A network engineer needs to use Amazon API Gateway in a shared services account to create an HTTP API to expose these microservices to external applications. The network engineer must ensure that access to the microservices can occur only over a private network. Additionally, the company must be able to control which entities from its internal network can connect to the microservices. In the future, the company will create more microservices that the company must be able to integrate with the application. What is the MOST secure solution that meets these requirements?
  1. Create an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALB. Create a VPC endpoint service in each microservice account. Create an AWS PrivateLink endpoint for those services in the shared services account. Add the elastic network interface IP addresses of the VPC endpoint as targets for the target group of the ALB. Correct Answer
  2. Create an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALConnect all the VPCs to each other by using a central transit gateway. Add the IP addresses of the NLB as IP-based targets in the ALB target group.
  3. Configure the integration to the API Gateway API by using HTTP-based integration. Connect all the VPCs to each other by using a central transit gateway. Create a separate HTTP integration to each NLB for each microservice. Add the HTTP endpoint of the NLB as the endpoint URL in the HTTP integration.
  4. Configure the integration to the API Gateway API by using VPC link integration. Connect all the VPCs to each other by using a central transit gateway. Create a separate VPC link to each NLB for each microservice. Add the HTTP endpoint of the NLB as the endpoint URL in the VPC link integration.

Key Takeaways

This question tests whether you know that HTTP API VPC links target Application Load Balancers, not NLBs, and that cross-account connectivity must be built with VPC endpoint services and PrivateLink interface endpoints.

The most secure approach is to use an API Gateway HTTP API with a VPC link to an ALB in a shared-services VPC, then terminate each microservice connection through PrivateLink VPC endpoints backed by VPC endpoint services. The community is split between A and D, but A is correct because HTTP API VPC links must target an ALB in the same account, and cross-account NLBs need PrivateLink rather than a direct VPC link.

Common mistake: Many candidates choose D because it seems like a direct private integration to each NLB. They miss that HTTP APIs do not support VPC links to NLBs and that a VPC link cannot cross accounts, so the ALB plus PrivateLink pattern in A is required.

Expert Analysis

Key Concepts

For Amazon API Gateway HTTP APIs, a VPC link provides a private integration between the API and resources inside a VPC. The target of an HTTP API VPC link must be an Application Load Balancer (ALB) or AWS Cloud Map, not a Network Load Balancer. To expose microservices in other accounts, the standard pattern is to create a VPC endpoint service in each microservice account, load it in the shared services account as an interface VPC endpoint, and place the endpoint's elastic network interface (ENI) IPs behind an ALB in the shared VPC.

Why Option A is Correct

Option A creates an ALB in the shared services VPC and attaches the API Gateway VPC link to that ALB. Each microservice account contributes a VPC endpoint service backed by its NLB. The shared services account creates a PrivateLink interface endpoint for each endpoint service, which provides private IP addresses in the shared VPC. The ALB target group can use IP-based targets with those ENI IP addresses. This design keeps all traffic within the AWS private network, provides fine-grained access control through security groups on the interface endpoints and through endpoint services that can be configured to require endpoint acceptance, and scales easily because new microservices only require a new endpoint service and a new target in the ALB.

Why Other Options Fail

  • B also uses an ALB and VPC link, but it relies on a transit gateway to connect all VPCs and adds NLB IPs directly as ALB targets. This opens broader network paths between all VPCs, does not provide service-level authorization, and is less secure than PrivateLink.
  • C uses HTTP-based integration without any VPC link, so traffic would not stay on the private network and API Gateway cannot reach private NLBs without a VPC link or public accessibility.
  • D is the most common wrong answer. It tries to create a separate VPC link directly to each NLB. For HTTP APIs, VPC links are not supported with NLBs, and a VPC link in the shared account cannot integrate with resources in a different AWS account. The cross-account private integration requires the ALB plus VPC endpoint service pattern from Option A.

Community Perspective

The exam community is split, with many votes for D, but the correct answer is A. One commenter correctly notes that a private integration requires the load balancer, VPC link, and HTTP API to be in the same AWS account (https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-private.html). The AWS whitepaper “Best practices for API Gateway private integrations” describes the cross-account HTTP API pattern as using an ALB in the middle with PrivateLink endpoints, matching Option A.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

For API Gateway private integration questions, first identify whether the API is HTTP or REST. HTTP API VPC links require an ALB or Cloud Map target, while REST APIs typically use an NLB. If the load balancer is in another account, think PrivateLink interface endpoints rather than a direct VPC link.

Community Votes

A
53%
D
47%

53% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. seochan 👍 4 Answered A
    I think it’s A VPC link - ensure using private network VPC endpoint service - scalable and secure (TGW need non-overlapping CIDR, hence no scalable, and you can access control using ENI SG)
  2. c1193d4 👍 3 Answered A
    D: incorrect because the API Gateway won't be able to reach the NLBs located in microservices accounts through the VPC Link created in the shared VPC account "To create a private integration, all resources must be owned by the same AWS account (including the load balancer or AWS Cloud Map service, VPC link and HTTP API)." in https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-private.html
  3. Akshay0403 👍 3 Answered D
    Option D is the most secure and scalable solution. It provides private network communication using VPC link integration and leverages a transit gateway for efficient VPC management. This approach ensures that traffic remains secure within the AWS network while offering the flexibility to control access and easily integrate new microservices in the future.
  4. luisgu 👍 2 Answered A
    See "Private integration cross-account" on this link: https://docs.aws.amazon.com/whitepapers/latest/best-practices-api-gateway-private-apis-integration/http-api.html
  5. kupo777 👍 2
    D is correct. A, B: HTTP API does not require ALB creation on the shared account side because the communication is to ENI. C: HTTP-based integration does not exist.
Show 4 more comments
  1. Ravan 👍 1 Answered A
    D. Incorrect VPC link configuration: The VPC link should be associated with the ALB, not the NLB.
  2. yeahaya 👍 3 Answered D
    D. i choice
  3. siheom 👍 3 Answered D
    VOTE D
  4. rdiaz 👍 1 Answered B
    TGW required.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

How Should Network Engineers Increase Payload Size Through a Transit Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide