Which solution will meet these requirements?
Implement a series of AWS WAF rules directly on the NLB to filter out unauthorized traffic.
Recreate the NLB with a security group to allow only trusted IP addresses.
Deploy a second NLB in parallel with the existing NLB configured with a strict IP address allow list.
Use AWS Shield Advanced to provide enhanced DDoS protection and prevent unauthorized access attempts.
Explanations:
AWS WAF cannot be directly implemented on a Network Load Balancer, as it is designed for application-level traffic (HTTP/HTTPS), not TCP traffic handled by NLBs.
Recreating the NLB with a security group allows for IP address filtering, enabling the restriction of access to only trusted IP addresses, enhancing security with minimal changes to the architecture.
Deploying a second NLB with an IP allow list adds complexity and does not address the unauthorized access attempts as effectively as modifying the existing NLB’s security settings.
AWS Shield Advanced primarily provides DDoS protection, but it does not specifically prevent unauthorized access attempts. It focuses on mitigating attack vectors rather than access control.
I draft that the answer is:
Recreate the NLB with a security group to allow only trusted IP addresses.
I opine that the answer is:
Recreate the NLB with a security group to allow only trusted IP addresses.