A web application runs on EC2 instances in private subnets across three Availability Zones behind an ALB. SSL/TLS is terminated at the ALB using ACM certificates. In testing with a single instance everything worked, but after production deployment users can log in but each new web request restarts the login flow. What should the network engineer do to fix this?

The problem describes users being logged out with each new request, indicating that their session state is not being maintained across requests. This is a classic symptom of requests from the same user being routed to different backend instances, each of which doesn't recognize the session initiated by another instance. Enabling stickiness (session affinity) on the ALB target group ensures that requests from a particular user are consistently routed to the same EC2 instance, preserving session state. Using an application-based cookie allows the application to manage session IDs, and setting the duration to the maximum session length ensures stickiness persists for the entire user session. Modifying the ALB listener rule to enable group-level stickiness is incorrect because stickiness is configured at the target group level, not the listener rule level. Replacing the ALB with an NLB is unnecessary and incorrect; NLBs operate at Layer 4 and do not support application-based stickiness, which is required for this scenario. Removing the ALB and using Route 53 with individual instance certificates is incorrect as it eliminates the load balancing and SSL termination benefits of the ALB and does not address the session state issue.