An ecommerce application runs on EC2 instances in an Auto Scaling group to handle variable customer demand. The company must distribute customer traffic to the instances and must ensure that traffic is encrypted end-to-end (no intermediate decryption). Which solution satisfies these requirements?

A Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and passes traffic directly to the target instances without decrypting it. This ensures end-to-end encryption, as the SSL/TLS termination occurs on the EC2 instances themselves. The TCP listener is appropriate for this scenario. An Application Load Balancer (ALB) operates at Layer 7 (HTTP/HTTPS) and typically terminates SSL/TLS at the load balancer, which would break the end-to-end encryption requirement. While it can re-encrypt to the backend, the initial decryption at the ALB violates the "no intermediate decryption" constraint. Amazon CloudFront is a Content Delivery Network (CDN) and is primarily used for caching and accelerating web content delivery, not for direct load balancing of backend EC2 instances in this manner, especially when end-to-end encryption without intermediate decryption is a strict requirement for the load balancer itself. A Gateway Load Balancer (GLB) is designed for deploying, scaling, and managing virtual appliances like firewalls and intrusion detection systems, not for distributing application traffic directly to EC2 instances.