AWS PrivateLink and AppFlow for Secure Salesforce Data

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Create an AWS PrivateLink connection in the VPC to Salesforce and use Amazon AppFlow to transfer data.

Question

A company uses Salesforce. The company needs to load existing data and ongoing data changes from Salesforce to Amazon Redshift for analysis. The company does not want the data to travel over the public internet. Which solution will meet these requirements with the LEAST development effort?
  1. Establish a VPN connection from the VPC to Salesforce. Use AWS Glue DataBrew to transfer data.
  2. Establish an AWS Direct Connect connection from the VPC to Salesforce. Use AWS Glue DataBrew to transfer data.
  3. Create an AWS PrivateLink connection in the VPC to Salesforce. Use Amazon AppFlow to transfer data. Correct Answer
  4. Create a VPC peering connection to Salesforce. Use Amazon AppFlow to transfer data.

Key Takeaways

The question tests secure connectivity to third-party SaaS applications; the common trap is selecting VPC peering or Direct Connect, which do not natively support private API endpoints for non-AWS services like Salesforce.

This page explains how to securely transfer data from Salesforce to Amazon Redshift without using the public internet, identifying AWS PrivateLink and AppFlow as the optimal solution. It clarifies why VPC peering and Direct Connect are incorrect for this specific SaaS integration scenario.

Common mistake: Learners often choose VPC peering (D) because they associate it with private networking, failing to realize that VPC peering only connects two AWS VPCs and cannot connect to external SaaS providers like Salesforce directly.

Expert Analysis

Why the Answer Is Correct

Option C is correct because AWS PrivateLink provides private connectivity between your VPC and supported AWS services or partner services, keeping traffic off the public internet. When combined with Amazon AppFlow—a fully managed integration service—this setup allows seamless, secure data transfer from Salesforce to Amazon Redshift with minimal development effort. AppFlow natively supports Salesforce as a source and Redshift as a destination, while PrivateLink ensures the connection remains private.

Why the Other Options Are Wrong

Option A and B suggest using AWS Glue DataBrew, which is primarily a visual data preparation tool, not an automated data ingestion pipeline for ongoing changes. Furthermore, establishing a VPN or Direct Connect (Options A and B) involves significant configuration effort compared to the managed nature of AppFlow. Option D suggests VPC peering, which is invalid because VPC peering can only connect two AWS VPCs; it cannot establish a connection to an external third-party service like Salesforce.

Community Comment Notes

Community consensus strongly favors Option C. As user Scheldon noted, PrivateLink is designed to connect VPCs to services privately without internet gateways or NAT devices. User LeonSauveterre highlighted that DataBrew is unsuitable for ongoing data loads and that VPC peering is strictly for AWS-to-AWS connections. Another commenter emphasized that third-party SaaS integrations require AppFlow rather than traditional network peering.

Exam Strategy

When connecting to third-party SaaS applications (like Salesforce, Slack, or ServiceNow) within AWS, always look for 'PrivateLink' for connectivity and 'AppFlow' for data movement. Avoid VPC peering as it does not work with external non-AWS entities.

Frequently Asked Questions

Why can't I use VPC Peering to connect to Salesforce?

VPC Peering only connects two AWS VPCs. Salesforce is an external SaaS provider and does not have a VPC that you can peer with.

Is AWS Glue DataBrew suitable for ongoing Salesforce data loads?

No, DataBrew is a data preparation tool for ad-hoc cleaning. AppFlow is designed for automated, ongoing data synchronization between SaaS and AWS services.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. Scheldon 👍 4 Answered C
    AnswerC To connect your own VPC with third-party VPC we need to use ProvateLink. AWS PrivateLink is a highly available, scalable technology that you can use to privately connect your VPC to services as if they were in your VPC. You do not need to use an internet gateway, NAT device, public IP address, AWS Direct Connect connection, or AWS Site-to-Site VPN connection to allow communication with the service from your private subnets. Therefore, you control the specific API endpoints, sites, and services that are reachable from your VPC. https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html
  2. LeonSauveterre 👍 3 Answered C
    A - VPN connection, public internet, no. B - Significant setup effort and cost. Also, DataBrew is not suitable for loading ongoing data changes. C - Amazon AppFlow is a fully managed integration service that natively supports Salesforce and Amazon Redshift. D - VPC peering is for connecting two AWS VPCs. Salesforce is external to AWS, so no.
  3. Kaula 👍 3
    C https://docs.aws.amazon.com/connect/latest/adminguide/integrate-salesforce-tasks.html https://docs.aws.amazon.com/connect/latest/adminguide/vpc-interface-endpoints.html
  4. MatAlves 👍 2 Answered C
    AWS PrivateLink: This service enables private connectivity between VPCs and supported AWS services, effectively keeping data off the public internet. It allows secure communication without exposing your data to the internet. Amazon AppFlow: This is a fully managed integration service that simplifies data transfer between SaaS applications (like Salesforce) and AWS services (like Amazon Redshift).
  5. mk168898 👍 2
    3rd party SaaS salesforce integration => Use AWS AppFlow So left C and D Not D because VPC Peering need 2 VPC and 3rd party SaaS does not have a VPC
Show 3 more comments
  1. KennethNg923 👍 2 Answered C
    Private link for sure
  2. Johnoppong101 👍 2 Answered C
    C is the answer
  3. Kaula 👍 2 Answered C
    Should be C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide