A service exposed as an ENI — reachable, never reaching back.
The provider's VPC has zero visibility into the consumer's VPC.
ProviderNLB in front of the service → creates a VPC Endpoint Service
ConsumerCreates an Interface Endpoint → gets an ENI resolving a private DNS name
ResultConsumer reaches provider; provider cannot reach consumer at all
The right choice for strict isolation, external/partner exposure, or overlapping CIDRs that make peering impossible outright.