A web translation service runs on EC2 instances in an Auto Scaling group behind an ALB in private subnets. Some customers (each in their own AWS account) must be allowed access to the service, but it must not be open to all customers. The solution should require minimal operational overhead. Which combination of steps meets these requirements? (Choose two.)

This solution uses AWS PrivateLink to provide private connectivity to the web translation service. PrivateLink allows customers to access the service privately from their VPCs without traversing the public internet, enhancing security and performance. Creating an AWS PrivateLink endpoint service and requiring acceptance ensures that only explicitly approved customer accounts can establish connections. This directly addresses the requirement for restricted access. Deploying an NLB with a listener that targets the ALB is necessary because PrivateLink endpoint services must be associated with an NLB, not directly with an ALB. The NLB acts as the front-end for the PrivateLink service, forwarding traffic to the ALB which then distributes it to the EC2 instances. VPC peering is less scalable and more complex to manage for multiple customers compared to PrivateLink. Configuring authentication on the load balancer does not restrict network access; it only controls application-level access, and the service would still be publicly accessible. Associating the ALB directly with the endpoint service is not possible as PrivateLink requires an NLB.