A company hosts a popular web application. The web application connects to a database running in a private VPC subnet. The weh servers must be accessible only to customers on an SSL connection. The ROS MySQL$.$ database server must be accessible only from the web servers.

How should the Architect design a solution to meet the requirements without impacting running applications?

Create a network ACL on the web server's subnet, and allow HTPS inbound and MySQL$.$ outbound. Place both database and web servers on the same subnet.

Open an HTTPS port on the security group for web servers and set the source to $0\mathrm{.}0\mathrm{.}0\mathrm{.}0\%.$ Open the MysQL port on the database security greun and attach it to the MySQL instance. Set the source to Web Server Security Group.

Create a network ACL on the web server's subnet, and allow HTTPS inbound, and sperify the source as $0\mathrm{.}0\mathrm{.}0\mathrm{.}0.$ Create a network ACL on a databas subnet, allow MySQL port inbound for web servers, and deny all outbound traffic.

Open the MySQL port on the security group for web servers and set the source to $0\mathrm{.}0\mathrm{.}0\mathrm{.}0.$ Open the HTTPS port on the database security group and attach it to the MySQL instance. Set the source to Web Server Security Group.