A financial institution is deploying a new application on AWS which must comply with regulatory requirements that sensitive data not traverse the public internet. Which service should they use to connect their on-premises data centers to AWS?