Question

A financial services company hosts a customer-facing web application in an AWS VPC. Security requires that all inbound connections from the internet must terminate at a managed edge that provides DDoS protection and web application filtering before traffic reaches the application subnets. The team also wants to avoid exposing EC2 instances with public IP addresses. Which cloud security design for inbound connectivity best meets these requirements?

Accepted Answer

Place the application behind an internet-facing Application Load Balancer with AWS WAF and AWS Shield, keeping EC2 instances in private subnets

Answer

Assign Elastic IPs to each EC2 instance and rely on security group rules to filter inbound HTTP/HTTPS traffic

Answer

Route inbound traffic through a NAT gateway so the EC2 instances remain private while accepting connections

Answer

Use a VPC interface endpoint (PrivateLink) to expose the application to internet clients without public IPs