A company is building a service that requires end-to-end encryption in transit so traffic is not decrypted between the client and the service backend. The service uses gRPC over TCP port 443 and must support thousands of concurrent connections. The backend runs on an Amazon EKS cluster with the Kubernetes Cluster Autoscaler and Horizontal Pod Autoscaler enabled. Mutual TLS is required for two-way authentication between clients and the backend. Which solution satisfies these requirements?

The correct solution uses an NLB with a TCP listener because it supports end-to-end encryption and mutual TLS by passing encrypted traffic directly to the backend pods. NLBs operate at Layer 4, preserving the client's source IP and allowing the backend to handle TLS termination and mutual authentication. Direct IP targeting of pods ensures efficient routing within the EKS cluster, especially with autoscaling. An Application Load Balancer (ALB) would terminate TLS at the load balancer, preventing end-to-end encryption and mutual TLS between the client and the backend. Registering the Auto Scaling group as a target would route traffic to nodes, not directly to pods, complicating pod-level traffic management and potentially requiring additional proxy layers on the nodes.