How should a solutions architect ensure that the web application can continue to call the third-party API after the migration?
Associate a block of customer-owned public IP addresses to the VPC. Enable public IP addressing for public subnets in the VPC.
Register a block of customer-owned public IP addresses in the AWS account. Create Elastic IP addresses from the address block and assign them to the NAT gateways in the VPC.
Create Elastic IP addresses from the block of customer-owned IP addresses. Assign the static Elastic IP addresses to the ALB.
Register a block of customer-owned public IP addresses in the AWS account. Set up AWS Global Accelerator to use Elastic IP addresses from the address block. Set the ALB as the accelerator endpoint.
Explanations:
Associating a block of customer-owned public IP addresses to the VPC and enabling public IP addressing for public subnets would not allow the EC2 instances in private subnets to directly communicate with the third-party API, as the communication must originate from the NAT gateways. Public IPs on the subnets do not solve the issue of the private instances needing to route their traffic through the NAT gateway.
Registering a block of customer-owned public IP addresses in the AWS account and creating Elastic IP addresses from this block to assign to the NAT gateways allows the traffic from the private EC2 instances to originate from these Elastic IPs. This setup will ensure that the requests to the third-party API will appear to come from the specified public IPs, which can be added to the third-party allow list.
Assigning Elastic IP addresses directly to the ALB does not help in this scenario because the EC2 instances in private subnets need to route their requests through a NAT gateway. The ALB is not the component making requests to the third-party API; therefore, this approach does not fulfill the requirement of allowing the private instances to communicate through a specific public IP address.
Setting up AWS Global Accelerator with Elastic IP addresses and the ALB as an endpoint does not address the requirement of allowing the EC2 instances to make requests to the third-party API. The Global Accelerator is designed to improve application availability and performance, but it does not allow outbound requests from private instances to appear under a specific public IP that is needed for the API allow list.
I reckon the answer is:
Register a block of customer-owned public IP addresses in the AWS account. Create Elastic IP addresses from the address block and assign them to the NAT gateways in the VPC.