A web application runs on EC2 instances behind an Application Load Balancer (ALB), and the ALB is the origin for a CloudFront distribution. The company uses a custom authentication system that issues a token to authenticated customers. The application must ensure GET/POST requests come only from authenticated customers. Design the MOST operationally efficient solution that lets the web application identify authorized customers.

Lambda@Edge is the most operationally efficient solution because it executes code at CloudFront edge locations, close to users, minimizing latency. It can inspect the request token before it reaches the ALB and origin, and then add a custom header to indicate authentication status to the web application. This offloads authentication logic from the ALB and EC2 instances, simplifying the application code and improving performance. Inspecting tokens at the ALB (first incorrect option) is less efficient as it's further from the user and adds processing to the ALB. Integrating WAF (second incorrect option) is primarily for security rules, not custom authentication logic, and still processes requests at the ALB. Deploying an EC2 instance with a third-party tool (fourth incorrect option) introduces significant operational overhead, cost, and a single point of failure, making it highly inefficient.