A SaaS provider exposes a proprietary service via AWS PrivateLink. The service runs on three EC2 instances behind a Network Load Balancer (NLB) in private subnets across multiple Availability Zones in eu-west-2. All customers are currently in eu-west-2, but a new customer in us-east-1 requires access. The company created a new VPC and subnets in us-east-1 and configured inter-Region VPC peering between the Regions. The company does not want to deploy new EC2 resources in us-east-1 immediately. Which solution enables the new us-east-1 customer to access the service without deploying instances in us-east-1?

The correct solution leverages AWS PrivateLink's ability to create a cross-Region endpoint service. A PrivateLink endpoint service in us-east-1 can directly reference an NLB in eu-west-2. This allows customers in us-east-1 to access the service securely and privately over the AWS backbone without deploying new infrastructure in us-east-1. The inter-Region VPC peering is not directly used for PrivateLink traffic but ensures general connectivity if needed. The other options are incorrect because: Creating an NLB in us-east-1 with IP targets in eu-west-2 would route traffic over the peering connection, which is not how PrivateLink is designed for cross-Region access to an existing NLB. Using an ALB in eu-west-2 and then an NLB in us-east-1 targeting the ALB is an overly complex setup that doesn't utilize PrivateLink's cross-Region capabilities efficiently. AWS RAM is for sharing resources, not for creating cross-Region PrivateLink access to EC2 instances directly via an NLB. PrivateLink endpoint services are designed to expose services behind NLBs.