A network engineer has built two IPsec VTI tunnels from an on-premises Cisco IOS XE router to a Cisco IOS XE router hosted in an AWS VPC. Both tunnels run eBGP and advertise the same on-premises prefixes. The engineer wants all traffic sourced from the cloud-hosted router destined to on-premises to prefer Tunnel1, using Tunnel2 only if Tunnel1 fails. Which BGP attribute should be configured, and on which router, to achieve this deterministic outbound path selection from the cloud router?