Answer: Use an interface endpoint.

## Explanation **Correct Answer: B - Use an interface endpoint.** **Why this is correct:** 1. **Private API Gateway Setup**: The company is using Amazon API Gateway as a private gateway within a VPC. Private API Gateway endpoints are only accessible from within the VPC. 2. **Current Issue**: The BuyStock API is calling the CheckFunds API over the internet instead of through the VPC. This happens because when one API Gateway endpoint calls another API Gateway endpoint, it needs to resolve the DNS name of the target API. 3. **Interface Endpoint Solution**: - An interface endpoint (AWS PrivateLink) creates a private connection between the VPC and AWS services without going over the internet. - By creating a VPC endpoint for API Gateway (interface endpoint), the DNS resolution for the API Gateway endpoint will resolve to a private IP address within the VPC. - This ensures that traffic between the two APIs stays entirely within the VPC network. - This solution requires minimal code changes - only the endpoint URL might need to be updated to use the VPC endpoint DNS name. **Why other options are incorrect:** **A. Add an X-API-Key header in the HTTP header for authorization.** - This addresses authentication/authorization but does not solve the routing problem. The traffic would still go over the internet. **C. Use a gateway endpoint.** - Gateway endpoints are only for Amazon S3 and DynamoDB, not for API Gateway. API Gateway requires interface endpoints (PrivateLink). **D. Add an Amazon Simple Queue Service (Amazon SQS) queue between the two REST APIs.** - This would require significant architectural changes and code modifications to implement asynchronous communication via queues, which is not the requirement with the "FEWEST changes to the code." **Key AWS Concepts:** - **VPC Endpoints**: Enable private connectivity between VPCs and AWS services without internet gateways, NAT devices, VPN connections, or AWS Direct Connect. - **Interface Endpoints**: Powered by AWS PrivateLink, they provide private connectivity to services like API Gateway, S3 (via gateway endpoint is different), Kinesis, etc. - **Gateway Endpoints**: Only for S3 and DynamoDB, use route tables to route traffic. - **Private API Gateway**: Can only be accessed from within the VPC using VPC endpoints. **Implementation Steps:** 1. Create a VPC endpoint for API Gateway (interface endpoint) in the same VPC. 2. Update the BuyStock API to call the CheckFunds API using the VPC endpoint DNS name. 3. Ensure proper security groups and network ACLs allow traffic between the APIs through the VPC endpoint.

Author: LeetQuiz Editorial Team