A company uses CloudFront with an Application Load Balancer (ALB) origin. The network engineer must ensure that all inbound traffic to the ALB originates from CloudFront, and the enforcement must be done at the network layer rather than in the application. Which solution is the MOST operationally efficient way to meet this requirement?

The most operationally efficient solution is to add an inbound rule to the ALB's security group allowing the AWS managed prefix list for CloudFront. Security groups operate at the instance/ENI level, providing network-layer enforcement. The AWS managed prefix list for CloudFront (com.amazonaws.global.cloudfront.origin-facing) automatically updates with CloudFront's IP ranges, ensuring ongoing accuracy without manual intervention, making it highly efficient. Network ACLs (NACLs) operate at the subnet level and are stateless, requiring separate rules for inbound and outbound traffic. While effective, managing them can be more complex than security groups for this specific use case, and they are less granular. Custom HTTP headers enforce at the application layer, not the network layer, and can be bypassed. Using AWS WAF with a Lambda function to update IP sets is overly complex and less efficient than leveraging the managed prefix list, which handles IP updates automatically.