lock down app security group: only allow connecting via LB