A medical company runs a REST API on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB is in three public subnets and the EC2 instances are in three private subnets. A CloudFront distribution uses the ALB as the origin. What should a solutions architect recommend to strengthen origin security (protecting the ALB from direct access) for requests coming from CloudFront?

This solution effectively strengthens origin security by ensuring only requests originating from the CloudFront distribution reach the ALB. CloudFront is configured to add a unique, rotating secret header to all requests it forwards to the ALB. An AWS WAF web ACL, associated with the ALB, then inspects incoming requests. It allows only those requests that contain the correct secret header, effectively blocking any direct access attempts to the ALB that bypass CloudFront. Secrets Manager provides secure storage and automatic rotation of the secret, enhancing security posture. The option to use an IP match condition with CloudFront service IP ranges is less secure because these IP ranges are publicly known and can be spoofed or used by malicious actors. Moving the ALB to private subnets would prevent direct internet access but wouldn't differentiate between legitimate CloudFront requests and other internal traffic if not combined with other security measures. Using Systems Manager Parameter Store for the secret is less secure than Secrets Manager, which is designed for credential management and rotation. AWS Shield Advanced is for DDoS protection and does not provide origin access control based on custom headers.