A financial services company must connect its on-premises data center to AWS using a dedicated private circuit. A security requirement states that all data traversing the Layer 2 link between the customer premises and the AWS Direct Connect location must be encrypted at line rate without adding routing overhead or reducing throughput. The design team wants to satisfy this at the physical link layer rather than relying on an IPsec tunnel over the connection. Which capability should the design recommend?