A municipal partner organization needs HTTPS access to an application behind a private Application Load Balancer in the city’s VPC. The city must not open the ALB security group to 0.0.0.0/0. Which connectivity approach best meets the requirement?
Select an answer to reveal the explanation.
Short Explanation
Opening the private ALB to the whole internet is like leaving City Hall’s side door unlocked for “just one partner.” PrivateLink or VPN gives that partner a private hallway to HTTPS—no 0.0.0.0/0 welcome mat.
Full Explanation
A municipal partner that needs HTTPS to an application behind a private Application Load Balancer should receive private connectivity, not a hole punched in the ALB security group to the entire internet. AWS PrivateLink (interface endpoints to an NLB/ALB service pattern) or a Site-to-Site VPN / Client VPN path lets partner traffic reach the private ALB over an encrypted private network while security groups remain scoped to the VPN CIDR, endpoint ENIs, or partner prefix lists. That preserves VPC segmentation and meets the city’s mandate to avoid 0.0.0.0/0 on the private load balancer.
Adding an inbound rule allowing TCP 443 from 0.0.0.0/0 and publishing the private IP fails the requirement by definition and collapses private-tier isolation; "private IP on a blog" still invites scanning once the path is world-open. Replacing the ALB with an unauthenticated public S3 static website fails because object hosting is not a substitute for a private application API and removes authentication and private networking controls. Disabling HTTPS for cleartext HTTP over the public internet fails encryption-in-transit and exposes partner sessions to interception.
Exam caveat: PrivateLink and VPN solve reachability; you still terminate TLS on the ALB with ACM and authorize the partner at the application or mutual-TLS layer as policy demands. Operational check: verify the ALB SG has no 0.0.0.0/0:443, confirm partner clients resolve and connect only via the PrivateLink/VPN path, and run an external port scan showing the ALB is not reachable from the public internet.