A web application is moved from on-premises to AWS. The third-party API it calls allows only a single public CIDR block to be whitelisted by each client. The web application will run on EC2 instances in private subnets behind an ALB in public subnets. NAT gateways provide internet access for the private instances. How should the architect ensure the third-party API continues to accept calls from the migrated application using the same client IP block?

The correct solution involves using customer-owned IP addresses (CoIPs) because the third-party API requires a single, static public CIDR block for whitelisting. By registering a block of CoIPs with AWS and allocating Elastic IP addresses from this block to the NAT gateways, all outbound traffic from the private EC2 instances will originate from these whitelisted CoIPs. This ensures the third-party API consistently sees the same client IP block. Associating a block of customer-owned public IP addresses to the VPC and enabling public IP addressing on public subnets is incorrect because the application instances are in private subnets, and enabling public IPs on public subnets wouldn't affect their outbound IP. Assigning static Elastic IP addresses from CoIPs to the ALB is incorrect because the ALB handles inbound traffic, not outbound traffic from the application instances to the third-party API. Using AWS Global Accelerator is incorrect because it's designed for improving global performance and availability, not for controlling the source IP of outbound calls from a VPC to an external API.