I have a load balancer with public IP, which delegates calls to two EC2 web servers on a private subnet in AWS VPC. For redundancy reasons, each on a separate private subnet. Let them be denoted as A1, A2.
These web servers are required to pass calls to another EC2 instance. Let it be denoted as B.
I want it to have incoming connections only from A1, A2.
However, For internal reasons, I do not want to duplicate this EC2 instance for every private subnet. Therefore, my suggested solution is to restrict B's security group to have inbound rule to accept connections only from A1, A2.
How can I restrict inbound traffic of an EC2 instance outside of my private subnets, so it will accept traffic only from instances from within the private subnets?
I believe I should look for the public IP of the internet gateways of these private subnets, however it seems that such is associated only with a public subnet.