A third-party SaaS provider runs its service inside a VPC on AWS and exposes its functionality through APIs. Your company will call those APIs from resources inside your VPC. Company policy requires private connectivity that does not traverse the public internet, and resources in your VPC must not be accessible from outside your VPC. All access must follow least privilege. Which solution satisfies these constraints?

This solution correctly uses AWS PrivateLink, which allows private connectivity between VPCs without traversing the public internet. The third-party SaaS provider exposes an endpoint service, and your company creates an interface VPC endpoint in its own VPC to connect to it. This establishes a one-way, private connection. Attaching a security group to the interface endpoint ensures that only permitted clients within your VPC can access the SaaS provider, adhering to least privilege and preventing external access to your resources. Establishing a Site-to-Site VPN is for connecting on-premises networks to AWS VPCs or connecting two VPCs over the internet (though it can be private with Direct Connect), but it's not the most efficient or secure for VPC-to-VPC private service access. VPC peering connects two VPCs directly, but it creates a transitive routing issue and doesn't offer the same granular control or isolation as PrivateLink for service consumption. Creating an endpoint service in your account and asking the third party to connect to it is the reverse of the required flow; the third party is the service provider, not the consumer in this scenario.