Question

A financial services company is deploying a payment processing API for external partners. Requirements: partners must whitelist a small set of static IP addresses in their firewalls; TLS termination must occur on the backend EC2 instances (not on the load balancer) because a hardware security module (HSM) integration is required; and the solution must support millions of concurrent connections with ultra-low latency. Which load balancing implementation meets all requirements?

Accepted Answer

Deploy a Network Load Balancer with a TCP listener on port 443, assign Elastic IPs per subnet, and forward traffic to an instance target group where TLS is terminated on the backend.

Answer

Deploy an Application Load Balancer with an HTTPS listener and import certificates into AWS Certificate Manager for TLS termination at the ALB.

Answer

Deploy a Network Load Balancer with a TLS listener so the NLB decrypts traffic before forwarding to the backend instances.

Answer

Deploy a Gateway Load Balancer with GENEVE encapsulation and forward decrypted traffic to backend appliances for TLS processing.