wtf( )unctionsystem design, drawn
← all problemsAWS SA ProHard

Two designs, and the load balancer the endpoint service will not take

The quote service is being offered to partner accounts over PrivateLink instead of the public internet. It has been behind an Application Load Balancer for years — path routing, host headers, a WAF, and TLS termination the partners already depend on — and none of that is up for negotiation.

Two designs came back from the review. Both keep every layer-7 feature. One of them can be created.

Choose the design that can actually be built as an endpoint service, without giving up the routing the ALB is doing.
?An endpoint service does not accept every load balancer, and the one this team already owns is not on the list.
Design AThe ALB is the endpoint service

Boundaries, outermost first: Provider VPC: Existing ALB (L7 routing), Quote service (HTTP) Consumer VPC: Partner app (other acct), Interface endpoint (their side) Connections: Partner app calls Interface endpoint Interface endpoint publishes to Existing ALB — endpoint service Existing ALB calls Quote service

Partner appother acct
Interface endpointtheir side
Existing ALBL7 routing
Quote serviceHTTP
Design BAn NLB in front of the ALB

Boundaries, outermost first: Provider VPC: New NLB (registered), Existing ALB (L7 routing), Quote service (HTTP) Consumer VPC: Partner app (other acct), Interface endpoint (their side) Connections: Partner app calls Interface endpoint Interface endpoint publishes to New NLB — endpoint service New NLB calls Existing ALB Existing ALB calls Quote service

Partner appother acct
Interface endpointtheir side
New NLBregistered
Existing ALBL7 routing
Quote serviceHTTP
Two designs, one brief. Read both, then choose the one that meets it.