Question

A CloudOps engineer deploys web servers in a private subnet behind an internet-facing Application Load Balancer. The subnet's security group allows inbound TCP 443 from the ALB and all outbound traffic. Users report that HTTPS requests time out. The engineer confirms the security group is correct and then reviews the subnet's network ACL, which allows inbound TCP 443 from the ALB subnet CIDR and outbound TCP 443 to the ALB subnet CIDR, denying everything else. What change will restore connectivity?

Accepted Answer

Add an outbound NACL rule allowing TCP ports 1024-65535 to the ALB subnet CIDR to permit return traffic to ephemeral ports.

Answer

Add an inbound NACL rule allowing TCP ports 1024-65535 from the ALB subnet CIDR.

Answer

Change the security group to explicitly allow outbound TCP 443 instead of all traffic.

Answer

Add an inbound NACL rule allowing all traffic from 0.0.0.0/0 to bypass the ALB restriction.