An application runs on three EC2 instances across three Availability Zones behind a Network Load Balancer (NLB). The administrator must restrict instance traffic so that only requests coming from the NLB are allowed. Which approach meets this requirement with the least operational work?

The most operationally simple way to restrict traffic to EC2 instances from an NLB is by referencing the NLB's security group in the EC2 instances' security group inbound rules. This allows the instances to accept traffic only from the NLB, as security groups are stateful and manage traffic at the instance level. Referencing the NLB's security group is dynamic; it automatically adapts if the NLB's underlying IP addresses change. Referencing the NLB's elastic network interfaces is less practical because these IPs can change, requiring manual updates. Using network ACLs with CIDR ranges is also less dynamic and more complex to manage, as NLB IP addresses are not static. Deploying a third-party firewall adds significant operational overhead and cost, which goes against the "least operational work" requirement.