A company created a VPC for a new application in a new AWS account. The VPC is peered to an existing VPC in another account in the same Region for database access. Amazon EC2 instances will be frequently created and terminated in the application VPC, but only some need to connect to the databases in the peered VPC over TCP port 1521. A security engineer must ensure that only the required instances can reach the databases. What should the engineer do?

The correct approach uses security group referencing. By creating a security group in the application VPC and referencing its ID in the database VPC's security group inbound rule, you ensure that only instances associated with that specific application security group can initiate connections to the database on port 1521. This provides granular control, as EC2 instances are frequently created and terminated, and avoids the need to update CIDR blocks. Incorrect options: Allowing all traffic from the application VPC CIDR is too permissive. Network ACLs are stateless and operate at the subnet level, making them less granular than security groups for instance-level control. Creating security groups in both VPCs that allow CIDRs is less granular and requires manual updates if the application VPC CIDR changes. Allowing all traffic from the application VPC CIDR in a Network ACL is too permissive and does not provide instance-level control.