>Azure can even configure mutual authentication between the LB & the underlying servers

You can achieve a similar effect in AWS, by declaring only the LB's security group as the source in servers' security group ingress rule.

Any requests sent directly to the servers simply wouldn't connect.