Requirement Analysis:

The application should only be accessible to subsidiary companies over TCP port 443.

Direct public internet access must be restricted.

Use AWS PrivateLink:

AWS PrivateLink allows secure access to services across accounts and VPCs without exposing them to the public internet.

Steps to Implement:

Parent Account:

Create aPrivateLink Endpoint Servicelinked to the Network Load Balancer (NLB).

Update the security group for the EC2 instances to allow traffic from the PrivateLink endpoint on TCP port 443.

Subsidiary Accounts:

CreateInterface Endpointsin the subsidiary VPCs. These endpoints securely route traffic to the parent company's application via PrivateLink.

Advantages of This Solution:

Compliance: Ensures secure communication without internet exposure.

Scalability: Easily supports all 1,500 subsidiaries.

Operational Simplicity: Centralized service in the parent account, while subsidiaries connect securely via endpoints.

AWS PrivateLink Documentation

Using Security Groups with AWS PrivateLink