A company uses on-premises ADFS with SSO for access to the AWS Management Console. A legacy web application was migrated to an Amazon EC2 instance and does not include built-in authentication. Employees need to access the application from anywhere on the internet, but access must be restricted to employees only, without modifying the application. How should a security engineer implement this?

The correct solution leverages an Application Load Balancer (ALB) with Amazon Cognito authentication. This allows the ALB to handle user authentication before requests reach the EC2 instance, satisfying the requirement to restrict access without modifying the legacy application. By configuring Cognito with SAML federation to ADFS, employees can use their existing on-premises credentials for single sign-on. Incorrect options: AWS IAM Identity Center (AWS Single Sign-On) primarily manages access to AWS accounts and applications integrated with it, not directly authenticating users for a web application running on an EC2 instance in this manner. An Amazon Cognito identity pool is typically used for granting AWS credentials to authenticated users for accessing AWS services, not for authenticating users directly to a web application. Installing a connector on the Active Directory server and using the Cognito SDK on the application would require modifying the application. Creating an AWS Lambda custom authorizer for a reverse proxy on EC2 would involve significant custom development and likely require modifications to the application's access patterns or the reverse proxy itself, which goes against the "without modifying the application" constraint.