What should a solution architect do to connect issue?

A computer is reviewing a recent migration of a three-tier application to a VPC. The security team discover that the principle of lest privilege is not being applied to Amazon EC2 security group ingress and egress rules between the application tiers.

What should a solution architect do to connect issue?
A . Create security group rules using the instance ID as the source destination.
B . Create security group rules using the security ID as the source or destination.
C . Create security group rules using the VPC CDR blocks as the source or destination
D . Create security group rules using the subnet CDR blocks as the source or destination

Answer: B

Explanation:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html