A company operates a centralized EC2 application in a shared VPC. Client applications in up to 10 business-unit VPCs must access the centralized application, which is fronted by a Network Load Balancer (NLB). Some business-unit VPC CIDR blocks overlap with the shared VPC and some overlap with each other. Only authorized business-unit VPCs should be allowed to reach the centralized application. Which network design provides the required connectivity from the business-unit VPCs to the centralized application?

The correct answer is to use a VPC endpoint service. This solution allows private connectivity from multiple consumer VPCs to a service hosted in a provider VPC, even with overlapping CIDR blocks, because traffic traverses the AWS network privately without using IP addresses from the consumer VPC. The require-acceptance option ensures that only authorized business units can connect. VPC peering (incorrect) does not support overlapping CIDR blocks, which is a stated requirement. AWS Transit Gateway (incorrect) also does not inherently solve the overlapping CIDR block problem between attached VPCs for direct communication, and while it can route traffic, it's not the most direct solution for a service exposed via an NLB with overlapping CIDRs. Site-to-Site VPN (incorrect) is typically used for connecting on-premises networks to AWS VPCs, not for inter-VPC communication within AWS, and also doesn't inherently resolve overlapping CIDR issues for direct communication.