A SaaS provider runs its application on EC2 instances in a VPC and sells it to several hundred customers, each of whom runs their own AWS account and VPC. Customers must reach the application over private AWS networking rather than the internet, several customers use VPC CIDR blocks that overlap with the provider's VPC and with each other, and a customer must not be able to reach any resource in the provider's VPC other than the application itself.