Is there a way to make sure accesses are coming only from a specific NLB? Under the current NLB limitations, I am not sure if there is a way.
AWS Network Load Balancer (NLB) does not have Security Group (SG), hence cannot use SG to verify the source is NLB.
NLB (instance ID target) preserves the source IP address of the external client, hence cannot use source IP to verify the source is NLB.
If you specify targets using an instance ID, the source IP addresses of the clients are preserved and provided to your applications.
You can put EC2 on the NAT subnet, and then point to this EC2 through NLB. This way, although your EC2 security group is set to 0.0.0.0/0, only NLB can access it.
One way you could possibly do this is by provisioning the NLB and its EC2 in a separate private subnet reserved just for them, and ensuring your routing rules do not allow other subnets in the VPC to route to the segregated private subnet.
As in the AWS NLB Document - Target Security Groups, cannot identify a NLB and make sure the access is only from the NLB if target type is instance. Need to use the client IP address which accesses the NLB.
Limits
Network Load Balancers do not have associated security groups. Therefore, the security groups for your targets must use IP addresses to allow traffic from the load balancer.
You cannot allow traffic from clients to targets through the load balancer using the security groups for the clients in the security groups for the targets. Use the client CIDR blocks in the target security groups instead.