How to set up EC2 with public IP for connections f

I have an EC2 instance (running kafka) which needs to access itself via public IPs, but I would like to not open the network ACLs to the whole world.

The rationale is that when a connection is made to a kafka broker, the broker advertises which kafka nodes are available. As kafka will be used inside and outside EC2, the only common option is for the broker to advertise its public IP.

My setup:

an instance, with public IP (not an elastic IP)
a vpc
a security group, allowing access to the kafka ports from my work network
an internet gateway
a route allowing external access via the gateway

The security group is as follow:

Custom TCP Rule, proto=TCP, port=9092, src=<my office network>
Custom TCP Rule, prtot=TCP, port=2181, src=<my office network>

In short, all works fine inside the instance if I use localhost. All works fine outside the instance if I use the public IP.

What I now want is to use kafka from inside the instance with the public IP.

If I open the kafka ports to the whole world:

Custom TCP Rule, proto=TCP, port=9092, src=0.0.0.0/0
Custom TCP Rule, prtot=TCP, port=2181, src=0.0.0.0/0

It works, as expected, but it does not feel safe.

How could I setup the network ACL to accept inbound traffic from my local instance/subnet/vpv (does not matter which) without opening too much?

Well, this is not clean, but it has the added advantage of not having to pay for external bandwidth.

I did not find a way as I expected (via the security groups), but just by updating the /etc/hosts on my ec2 instance, and actually using a hostname instead of an IP, all works as expected.

For instance, if I give the instance the hostname kafka.example.com, then by having the following line in /etc/hosts: