A financial services company requires secure remote access for its employees to access internal resources hosted on AWS. The company wants to avoid exposing the instances to the public internet. Which AWS service would you recommend to achieve secure remote access without exposing the instances?