A company migrated a web application to AWS. The architecture uses an Amazon CloudFront distribution that forwards requests to an Application Load Balancer (ALB), and Amazon ECS handles the application processing. A security audit found the application is reachable directly via both the CloudFront domain and the ALB endpoint. The company requires that the application be accessible only through CloudFront. Which solution accomplishes this with the LEAST effort?

The correct solution is to update the ALB security group ingress to allow access only from the com.amazonaws.global.cloudfront.origin-facing CloudFront managed prefix list. This prefix list contains the IP addresses that CloudFront uses to communicate with origin servers, ensuring that only requests originating from CloudFront can reach the ALB. This is the least effort because AWS maintains and updates this prefix list automatically. Creating a new security group for CloudFront and updating the ALB security group is not feasible, as CloudFront does not directly use security groups for its outbound connections to origins. Extracting CloudFront IP addresses from ip-ranges.json is inefficient and prone to errors, as these IP ranges change frequently and would require constant manual updates. Changing the ALB scheme to internal would make it inaccessible to CloudFront, which requires an internet-facing or internal ALB reachable from CloudFront's edge locations.