An application needs the client IP address but now runs behind an Application Load Balancer, so all requests appear to come from the same IP. The application must remain horizontally scalable. What is the MOST cost-effective fix?

The correct option is to modify the application to read the X-Forwarded-For header. Application Load Balancers (ALBs) automatically add this header to HTTP requests, containing the original client's IP address. The application needs to be updated to parse this header, which may contain a comma-separated list of IPs if multiple proxies are involved. This is the most cost-effective and scalable solution as it leverages existing ALB functionality without architectural changes or additional costs. Removing the application from the ALB and deleting it is incorrect because it sacrifices horizontal scalability and high availability, which are crucial benefits of using a load balancer. Creating a Classic Load Balancer is also incorrect; while Classic Load Balancers do pass the X-Forwarded-For header, ALBs are generally preferred for HTTP/HTTPS traffic due to advanced features and better performance, and switching would incur unnecessary effort without solving the core problem differently. Modifying the client to send a custom header is impractical and insecure, as clients cannot reliably know or send their own public IP address, and it would require changes to every client application.