title: How to limit the access to EC2 from NLB only
body: <h1>Question</h1>
  
  <p>Is there a way to make sure accesses are coming only from a specific NLB? Under the current NLB limitations, I am not sure if there is a way.</p>
  
  <h3>Limitations</h3>
  
  <ul>
  <li><p>AWS Network Load Balancer (NLB) does not have Security Group (SG), hence cannot use SG to verify the source is NLB.</p></li>
  <li><p>NLB (instance ID target) preserves the source IP address of the external client, hence cannot use source IP to verify the source is NLB.</p></li>
  </ul>
  
  <h1>References</h1>
  
  <ul>
  <li><a href="https://forums.aws.amazon.com/thread.jspa?threadID=263245" rel="noreferrer">Network Load Balancers don't have Security Groups</a></li>
  <li><a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#target-type" rel="noreferrer">Source IP Preservation</a>
  
  <blockquote>
    <p>If you specify targets using an instance ID, the source IP addresses of the clients are preserved and provided to your applications.</p>
  </blockquote></li>
  </ul>