A company has 20 service teams, each in its own AWS account and each VPC using 192.168.0.0/22. Services run on EC2 instances behind ALBs and currently communicate over the public internet. Security now requires all cross-service traffic use HTTPS over private networking without routing through the internet. The solution should minimize changes required by each team. Which approach meets these requirements?

The correct answer uses AWS PrivateLink, which allows services to communicate privately across VPCs and accounts without traversing the public internet. By creating an NLB in each service VPC and exposing it via a PrivateLink VPC endpoint service, other accounts can create interface endpoints in their VPCs to access the service. This approach uses private IP addresses, maintains HTTPS, and minimizes changes for each team as they only need to update their service endpoints to the PrivateLink DNS names. Incorrect options: Sharing subnets via RAM and launching new resources is disruptive and requires significant changes to each team's deployment process. VPC peering between 20 VPCs would result in a complex mesh (20 19 / 2 = 190 peering connections), making management difficult and not scaling well. It also doesn't inherently solve the private endpoint discovery problem as efficiently as PrivateLink. A Transit Gateway would provide private connectivity but still requires each team to update their routing and potentially manage security groups for inter-VPC traffic. While it centralizes routing, it doesn't offer the same simplified service consumption model as PrivateLink for exposing individual services.