A third-party web application packaged as a Docker image runs on AWS Fargate (Amazon ECS) behind an Application Load Balancer (ALB). Only a specific list of users must be allowed internet access to the application. The application cannot be modified and cannot be integrated with an external identity provider. All users must authenticate with multi-factor authentication (MFA). Which solution satisfies these constraints?

The correct solution leverages Amazon Cognito User Pools, which directly integrate with Application Load Balancers (ALBs) for authentication. This allows the ALB to handle user authentication, including multi-factor authentication (MFA), before forwarding requests to the Fargate application. This approach meets all requirements: restricting access to specific users, enforcing MFA, and not requiring modifications to the application. Incorrect options: AWS IAM authentication for ALBs is primarily for authenticating AWS principals (e.g., EC2 instances), not external internet users. AWS IAM Identity Center (AWS SSO) does not directly integrate with ALBs for user authentication in this manner. Resource protection for ALBs typically refers to services like AWS WAF, not user authentication. AWS Amplify is a development platform that uses Amazon Cognito for authentication. While it creates a Cognito User Pool, directly configuring the ALB with the Cognito User Pool is the most direct and appropriate solution for this scenario, rather than involving the broader Amplify framework.