One backbone, one service mesh, one external door.
A multi-tenant SaaS company layers all three connectivity tools by role.
"Dozens of teams, one shared-services VPC, and one API enterprise customers connect to directly — three different relationships, three different tools."
Transit Gateway
Internal backbone — every team VPC + shared services
VPC Lattice
Service-to-service calls between teams, IAM auth built in
PrivateLink
The one customer-facing API, tightest isolation only