A company migrated an application to AWS using EC2 instances in an Auto Scaling group across multiple AZs. The application calls a third-party vendor data service over HTTPS that uses a static ACL to allow specific client IP addresses. The company has a working Direct Connect to on premises. The network engineer must design a solution so the scaled application can continue accessing the vendor service while minimizing the need to update the vendor's allow list. Which solution meets this requirement with the least ongoing changes to the vendor's allow list?

The correct option is to deploy a private NAT gateway in each Availability Zone and provide their IP addresses to the vendor. NAT gateways provide a static, public IP address for outbound traffic from instances in private subnets. By routing all application egress through these NAT gateways, the application's source IP address, as seen by the vendor, will always be one of the NAT gateway's elastic IP addresses, regardless of how many instances scale up or down. This minimizes changes to the vendor's allow list. Incorrect options: Creating ENIs and associating them with the Auto Scaling group is not feasible for outbound traffic source IP control and would require frequent updates as instances are replaced. Creating EC2 instances with ENIs to route traffic through them is an overly complex and less scalable solution compared to NAT gateways, requiring manual management and potentially introducing single points of failure or performance bottlenecks. Deploying an ALB and using the vendor's IP as a target is incorrect because ALBs are for inbound traffic to the application, not for controlling the source IP of outbound traffic from the application to a third party.