A municipal partner organization needs HTTPS access to an application behind a private Application Load Balancer in the city’s VPC. The city must not open the ALB security group to 0.0.0.0/0. Which connectivity approach best meets the requirement?
Select an answer to reveal the explanation.
Short Explanation
Opening the private ALB to the whole internet is like leaving City Hall’s side door unlocked for “just one partner.” PrivateLink or VPN gives that partner a private hallway to HTTPS—no 0.0.0.0/0 welcome mat.
Full Explanation
Partner access to private applications should use private connectivity patterns such as PrivateLink or VPN rather than world-open security groups on a private ALB. That preserves network segmentation while still allowing HTTPS. Public S3 websites and cleartext HTTP fail confidentiality and do not correctly expose private ALB workloads to a trusted partner.