A financial institution wants to securely connect their on-premises data center to an AWS VPC without using the public internet. They also need to control the network traffic routing between their on-premises environment and AWS. Which AWS service should they implement?