Question

A financial services company runs a legacy trading API behind an Application Load Balancer (ALB) in a single region. A newly onboarded partner requires that all traffic to the API traverse a small set of static, allowlisted IP addresses through their corporate firewall, and they demand the lowest possible connection latency for high-frequency requests. The current ALB exposes only DNS names, and the partner cannot allowlist DNS names or the ALB's changing IP ranges. The solutions architect must refactor the ingress without rewriting the application, which relies on host-based HTTP routing rules already configured on the ALB. Which approach best satisfies the requirements?

Accepted Answer

Deploy AWS Global Accelerator in front of the existing ALB to provide two static anycast IP addresses and reduced latency via the AWS global network.

Answer

Replace the ALB with a Network Load Balancer (NLB) that has Elastic IPs, and move the host-based routing logic into the application tier.

Answer

Place an Amazon CloudFront distribution in front of the ALB and provide the partner with CloudFront's IP ranges to allowlist.

Answer

Assign Elastic IPs directly to the ALB and share those addresses with the partner for firewall allowlisting.