A company needs private connectivity from its VPC to a service hosted in an external provider's VPC. The connection must be private, restricted to the target service, and must be initiated only from the company's VPC. Which solution meets these requirements?

The correct solution is to ask the provider to create a VPC endpoint for the target service and use AWS PrivateLink. AWS PrivateLink allows private connectivity to services hosted in other VPCs without exposing traffic to the public internet. The provider creates an endpoint service, and the company creates an interface VPC endpoint in their VPC, establishing a private, one-way connection. This meets all requirements: private, restricted to the target service, and initiated only from the company's VPC. VPC peering is incorrect because it creates a full network connection between VPCs, which is not restricted to a single service and allows two-way initiation. A NAT gateway is for outbound internet access and doesn't provide private connectivity to another VPC. A virtual private gateway is used for VPN or Direct Connect connections to on-premises networks, not for private connectivity between two AWS VPCs for a specific service.