An application is reachable both through a CloudFront distribution and directly via an internet-facing Application Load Balancer (ALB). The administrator must ensure the app is only accessible through CloudFront and not directly through the ALB, without modifying the application code. Which configuration accomplishes this?

The correct approach is to add a custom HTTP header in CloudFront's origin configuration and configure an ALB listener rule to only forward requests containing that specific header and value, defaulting to a 403 Forbidden for others. This ensures that only requests proxied through CloudFront, which adds the custom header, reach the application. Direct access to the ALB will lack this header and be blocked. Converting the ALB to an internal type (Option A) would prevent CloudFront from reaching it, as CloudFront origins must be publicly accessible. Lambda@Edge (Option B) is an overly complex solution for this specific problem and introduces additional latency and cost. Replacing the public ALB with an internal one (Option C) also makes it inaccessible to CloudFront, similar to Option A.