title: Restrict access to the AWS ALB only to the NLB
body: <p>We have created a few REST services on EC2 and exposing them through <code>API Gateway Rest API - Public</code> as shown below.</p>
  <p>API Gateway --(via VPC PrivateLink)--&gt; NLB -&gt; ALB -&gt; EC2</p>
  <p>We would like to make sure that NLB is the only one accessing the ALB, but NLB doesn't have Security Group.</p>
  <p>How do restrict to make sure NLB is the only accessing the ALB and no one else?</p>