A company runs roughly 50 application VPCs across several accounts, all attached to a central Transit Gateway. Many of these VPCs call the same AWS service APIs privately, and each VPC currently provisions its own set of interface VPC endpoints for those services. A cost review shows the per-endpoint hourly charge multiplied across 50 VPCs is now significant, and the platform team wants to keep traffic private to the service while drastically cutting the number of interface endpoints and the ongoing management of them. Which design MOST cost-effectively delivers private service access at this scale?
- AReplace the interface endpoints with gateway VPC endpoints in every application VPC, since gateway endpoints carry no hourly charge and can front the same set of AWS service APIs the VPCs call.
- BHost one shared set of interface VPC endpoints in a central VPC attached to the Transit Gateway, route the application VPCs to it through the Transit Gateway, and resolve the endpoint names centrally for all spokes. Correct
- CEstablish VPC peering from each application VPC to one endpoint-hosting VPC so the shared interface endpoints are reachable, accepting a full mesh of peering connections to every spoke.
- DKeep an interface endpoint in each VPC but switch them to private DNS disabled, which removes the hourly charge while still routing the application traffic privately to the AWS services.
Why A is wrong: Gateway VPC endpoints are free but support only Amazon S3 and DynamoDB, so they cannot replace interface endpoints for the broader set of service APIs these VPCs consume.
Why B is correct: Centralising the interface endpoints in one shared VPC and reaching them over the Transit Gateway collapses 50 duplicated endpoint sets into a single managed set while keeping service traffic private and inherited by new spokes.
Why C is wrong: A full peering mesh to 50 spokes reintroduces exactly the point-to-point sprawl the Transit Gateway exists to avoid, adding many connections and route entries rather than reducing management overhead.
Why D is wrong: Disabling private DNS only changes name resolution behaviour and does not remove the per-endpoint hourly charge, so the 50 duplicated endpoints and their cost remain in place.