A company runs a multi-account AWS environment with a centralized inspection VPC. The security team must deploy a third-party next-generation firewall appliance (from a vendor in AWS Marketplace) to inspect all north-south and east-west traffic. They require the solution to scale automatically across multiple appliance instances, preserve traffic symmetry (return traffic reaches the same appliance), and integrate transparently into the existing traffic flow without requiring source/destination changes to packets. Which AWS service should they use to insert the third-party appliances into the traffic path?