A security engineer at a large enterprise manages a data processing application used by 1,500 subsidiary companies. The parent company and all subsidiaries use AWS. The application listens on TCP port 443 and runs on Amazon EC2 behind a Network Load Balancer (NLB). For compliance, the application must be accessible only to subsidiaries and must not be exposed to the public internet. The engineer has received the public and private CIDR ranges for each subsidiary. Which solution should the engineer implement to enforce these access restrictions?

AWS PrivateLink provides private connectivity between VPCs, services, and on-premises applications, ensuring traffic does not traverse the public internet. By creating an endpoint service attached to the NLB in the parent account, and then having each subsidiary create an interface VPC endpoint, the application becomes privately accessible only to authorized subsidiaries. This meets the compliance requirement of not exposing the application to the public internet and restricts access to specific subsidiaries. The security group on the instances should allow traffic from the PrivateLink endpoint, not directly from the subsidiaries' CIDRs. Incorrect options: Network ACLs are stateless and would require managing 1,500 CIDR ranges, which is cumbersome and less secure than PrivateLink. Associating with both NLB and EC2 instances is redundant and still exposes the NLB publicly. Security groups attached to the NLB would still expose the NLB publicly, failing the "not exposed to the public internet" requirement. Managing 1,500 CIDR ranges in a security group is impractical and hits AWS limits for rules. Attaching a security group directly to EC2 instances with 1,500 CIDR ranges would expose the instances publicly if the NLB is public, and is not scalable or secure for this use case.