Accessing RDS Across VPCs Without Internet Gateway

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources. Determine high-performing and/or scalable network architectures.

Short answer

C Use AWS PrivateLink with a Network Load Balancer in front of the vendor's RDS database to establish private cross-account connectivity.

Question

A company collects and processes data from a vendor. The vendor stores its data in an Amazon RDS for MySQL database in the vendor's own AWS account. The company’s VPC does not have an internet gateway, an AWS Direct Connect connection, or an AWS Site-to-Site VPN connection. The company needs to access the data that is in the vendor database. Which solution will meet this requirement?
  1. Instruct the vendor to sign up for the AWS Hosted Connection Direct Connect Program. Use VPC peering to connect the company's VPC and the vendor's VPC.
  2. Configure a client VPN connection between the company's VPC and the vendor's VPC. Use VPC peering to connect the company's VPC and the vendor's VPC.
  3. Instruct the vendor to create a Network Load Balancer (NLB). Place the NLB in front of the Amazon RDS for MySQL database. Use AWS PrivateLink to integrate the company's VPC and the vendor's VPC. Correct Answer
  4. Use AWS Transit Gateway to integrate the company's VPC and the vendor's VPC. Use VPC peering to connect the company’s VPC and the vendor's VPC.

Key Takeaways

The question tests private cross-account VPC connectivity without public internet paths, trapping learners who assume VPC peering alone is sufficient or that Transit Gateway requires an internet gateway.

AWS PrivateLink provides private connectivity between VPCs without requiring an internet gateway, VPN, or Direct Connect. This page confirms that placing a Network Load Balancer in front of RDS and using PrivateLink is the correct architecture for cross-account database access.

Common mistake: Choosing VPC peering options (A, B, or D) because they seem simpler, ignoring that the options pair peering with unnecessary or invalid hybrid networking components like Direct Connect or Client VPN.

Expert Analysis

Why the Answer Is Correct

AWS PrivateLink allows a consumer VPC to access a service in a provider VPC using private IP addresses, entirely bypassing the need for an internet gateway, NAT device, or VPN connection. By placing a Network Load Balancer in front of the Amazon RDS for MySQL database, the vendor can expose the database as a VPC endpoint service. The company then creates an interface VPC endpoint in their own VPC, establishing private connectivity without overlapping CIDR restrictions.

Why the Other Options Are Wrong

Option A incorrectly requires a Direct Connect hosted connection, which is used for hybrid connectivity from on-premises to AWS, not for VPC-to-VPC connectivity. Option B misapplies Client VPN, which is designed for client-to-VPC access, and combining it with VPC peering is redundant and invalid. Option D redundantly combines AWS Transit Gateway with VPC peering; furthermore, neither component inherently solves the specific requirement without route tables, and the phrasing suggests an invalid architecture.

Community Comment Notes

Commenters highlight that PrivateLink requires no internet gateway or route table updates, as sandordini noted: "NO Internet Gateway, NO NAT GAteway, No Route table". LeonSauvaterre pointed out that "A Network Load Balancer acts as the integration point for PrivateLink." Nm55569 provided the exact AWS blog reference detailing this architecture.

Official Reference

https://aws.amazon.com/blogs/database/access-amazon-rds-across-vpcs-using-aws-privatelink-and-network-load-balancer/

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question specifies no internet gateway, VPN, or Direct Connect, eliminate any options relying on them and focus on VPC peering or PrivateLink. If VPC peering options are paired with invalid components or overlapping CIDRs might be an issue, PrivateLink is the correct choice.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. Ucy 👍 14
    Pour yourself a cold beer, when you get to this question, its been a very long run
  2. sandordini 👍 4 Answered C
    Private link: Does not require VPC linking: NO Internet Gateway, NO NAT GAteway, No Route table Needs NLB on Service VPC, and ENI on the Customer VPC
  3. Sivaeas 👍 3 Answered C
    AWS PrivateLink: AWS PrivateLink enables you to privately access services hosted on AWS in a highly available and scalable manner. With PrivateLink, you can access the vendor's RDS for MySQL instance securely without exposing it to the public internet. The vendor can create a VPC endpoint for RDS within their own VPC, which acts as an entry point for accessing the RDS instance. This endpoint can then be shared with the company. The company can create a VPC endpoint service in their VPC and accept the endpoint connection request from the vendor. This allows the company's resources to communicate with the RDS instance securely through PrivateLink.
  4. LeonSauveterre 👍 3 Answered C
    PrivateLink: AWS PrivateLink enables secure and private access to resources (like RDS) across accounts and VPCs using interface endpoints. It avoids exposing the database to the internet. NLB: A Network Load Balancer acts as the integration point for PrivateLink. The vendor's NLB will route traffic to the RDS database. VPC Without Internet Gateway: PrivateLink works even if the company's VPC does not have an internet gateway because communication occurs over private AWS infrastructure. Option A, B, and D all mention VPC Peering, but it doesn't enable direct access to RDS without additional routing or security configurations.
  5. 1dd 👍 3 Answered C
    Plz commit the previous comment, A involve- Direct connect B involve - peering required same region D involve - uses internet gateway
Show 8 more comments
  1. rondelldell 👍 2
    D You can peer both intra-Region and inter-Region transit gateways, and route traffic between them, which includes IPv4 and IPv6 traffic. To do this, create a peering attachment on your transit gateway, and specify a transit gateway. The peer transit gateway can be in your account or a different AWS account. After you create a peering attachment request, the owner of the peer transit gateway (also referred to as the accepter transit gateway) must accept the request. To route traffic between the transit gateways, add a static route to the transit gateway route table that points to the transit gateway peering attachment. https://docs.aws.amazon.com/vpc/latest/tgw/tgw-peering.html
  2. Scheldon 👍 2 Answered C
    AnswerC AWS PrivateLink enables you to connect to some AWS services, services hosted by other AWS accounts (referred to as endpoint services), and supported AWS Marketplace partner services, via private IP addresses in your VPC. The interface endpoints are created directly inside of your VPC, using elastic network interfaces and IP addresses in your VPC’s subnets. That means that VPC Security Groups can be used to manage access to the endpoints. https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-privatelink.html
  3. Nm55569 👍 2 Answered C
    https://aws.amazon.com/blogs/database/access-amazon-rds-across-vpcs-using-aws-privatelink-and-network-load-balancer/
  4. lenotc 👍 1 Answered C
    C is correct: https://aws.amazon.com/blogs/networking-and-content-delivery/how-to-securely-publish-internet-applications-at-scale-using-application-load-balancer-and-aws-privatelink/
  5. TwinSpark 👍 1
    I think i go for C, because if you exclude Dirct connect, VPN and GW so only C is available. but create an NLB zo do not want provision a transit GW sounds weird to me
  6. xBUGx 👍 1
    D does not involve internet. But TGW is unnecessary. A is more simple and clear.
  7. 1dd 👍 1 Answered A
    No internet gateway XD No Direct connect XC No Peering XB
  8. asdfcdsxdfc 👍 3
    Shouldn't it be D?

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide