Contoso Retail runs an internet-facing Application Load Balancer (ALB) and several other public-facing services in the same public subnets. The security team needs to immediately block abusive traffic originating from 198.51.100.0/24 for all resources in those subnets, not just the ALB. What should they do?

Network Access Control Lists (NACLs) operate at the subnet level, making them the ideal choice for blocking traffic to all resources within those subnets. By adding an inbound deny rule to the NACL associated with the public subnets, the specified IP range will be blocked before it reaches any instances or services in those subnets. Adding a deny rule to the ALB security group would only protect the ALB, not other public-facing services. Associating an AWS WAF web ACL with the ALB would also only protect the ALB. Modifying the route table to blackhole the traffic would prevent all traffic from that IP range from reaching the subnet, but NACLs are specifically designed for this type of access control and offer more granular control over inbound and outbound traffic at the subnet level.