Restricting AWS resources to same AZ connections

Let's suppose I have a ALB and a couple of EC2 instances (in auto scaling) spread over 3 AZs. And I also have a MultiAZ RDS instance with a few read replicas also spread across the same 3 AZs.

My question now is, how do I prevent my EC2 instances in one AZ from connecting to replicas in a different AZ while still maintaining failover and requiring minimal manual configuration. Assume I have a private Route53 zone that contains CNAME records (simple routing) pointing to my RDS instances if that makes things easier.

This is primarily to reduce connection latency and save on cost since AWS does charge for cross AZ traffic.

Given your AZs have a distinctive private IP range, you can create a Security Group that you can assign to your services in the AZ that blocks traffic from your other AZ private ranges.