A cloud engineer deploys several virtual machines into a single subnet within a VPC on a public cloud provider. Management requires that only inbound TCP traffic on port 443 be permitted to these VMs from the internet, while all other inbound traffic is denied. The engineer wants to enforce this rule at the VM/subnet level without deploying an additional appliance. Which cloud construct should the engineer configure?