A network engineer must enforce subnet-level isolation between two tiers of ECS instances residing in different vSwitches, applying consistent inbound and outbound rules across those vSwitches. The team notes that return traffic for allowed inbound rules must be handled explicitly. Which access control mechanism best fits these requirements?