Amazon AWS EC2 - How to restrict traffic to be received only from Elastic Load Balancer?

1-No one knows your EC2 IP address, so if you put it behind ELB, everyone can see the ELB IP address.

2-You can use the security group to limit access to your EC2 only from ELB.

Edit your EC2 security group and add your ELB security group name, after that, only ELB can access your EC2 directly.

For more info read the following docs:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html

https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-groups.html

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-update-security-groups.html

You should limit access to your ec2 to only traffic from ELB unless you have a specific reason not to.

You will have a security group assigned to ELB such as sg-xxxxxx. Make sure that when you create another security group for your ec2, it's ingress for 80/8080/443 (depending on ports you are using) are not CIDRs specific, but use security group assigned to ELB instead. Obiously make sure that this security group account for both, forwarding traffic and health check traffic, as ELB won't send traffic to unhealthy nodes.

Ideally you have both private and public subnets in your VPC, in which case put your ELB in public and EC2 in private subnets.