A company is migrating a containerized app. An ingress VPC has an NLB that sends traffic to front-end pods in an EKS cluster. The front end directs users to one of 10 services VPCs, each of which uses an NLB to distribute to service pods in EKS. The company expects over 10 TB/month of data transfer from the ingress VPC to services VPCs and wants the lowest-cost design for VPC-to-VPC communication. Which design meets the requirements at the LOWEST cost?

VPC peering is the lowest-cost option for direct VPC-to-VPC communication when the number of connections is manageable, as data transfer costs over peering connections are lower than those for Transit Gateway. With 10 services VPCs, 10 peering connections from the ingress VPC are feasible. Using zonal DNS names for the NLBs in the services VPCs ensures that traffic from the ingress VPC stays within the same Availability Zone when possible, minimizing cross-AZ data transfer charges, which are a significant cost factor for high data volumes. Transit Gateway incurs higher data processing charges per GB compared to VPC peering, making it more expensive for this specific high-volume, direct VPC-to-VPC scenario. AWS PrivateLink is designed for exposing services securely to other VPCs without traversing the public internet, but it also incurs data processing charges per GB and endpoint charges, which would be higher than direct VPC peering for internal, high-volume traffic between owned VPCs. Turning off cross-AZ load balancing on a Transit Gateway is not a standard configuration and does not directly reduce data transfer costs between VPCs in the same way zonal DNS with peering does.