SAP-C02 Q596 · Networking

Question

How can applications in multiple AWS accounts privately access a PostgreSQL RDS instance in a separate AWS account, while managing the number of connections?

Accepted Answer

This question has **two distinct requirements**: (1) **Private cross-account access** to an RDS instance, and (2) **Connection management** (pooling/limiting connections). Answer B satisfies both:

**Requirement 1 — Private Cross-Account Access:**
- **AWS PrivateLink** (VPC Endpoint Services) is the gold standard for sharing services across AWS accounts **privately** without exposing traffic to the public internet or requiring complex peering/routing.
- Architecture: RDS Proxy sits in the RDS account → A **Network Load Balancer (NLB)** is placed in front of RDS Proxy → An **Endpoint Service** is created from the NLB → Consumer accounts create **VPC Interface Endpoints** to connect.
- Traffic stays entirely on the AWS private backbone. No VPC peering, no transit gateway, no overlapping CIDR

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips