Question
========

Is there a way to make sure accesses are coming only from a specific NLB? Under the current NLB limitations, I am not sure if there is a way.

### Limitations

* AWS Network Load Balancer (NLB) does not have Security Group (SG), hence cannot use SG to verify the source is NLB.
* NLB (instance ID target) preserves the source IP address of the external client, hence cannot use source IP to verify the source is NLB.

References
==========

* [Network Load Balancers don't have Security Groups](https://forums.aws.amazon.com/thread.jspa?threadID=263245)
* [Source IP Preservation](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#target-type)

> 
> If you specify targets using an instance ID, the source IP addresses of the clients are preserved and provided to your applications.
> 
> 
>