Which AWS resource or service will meet this requirement?

Explanations:

AWS Shield is primarily a DDoS protection service. It does not control network traffic at the instance level but rather helps protect applications from distributed denial-of-service attacks.

Security groups act as virtual firewalls for Amazon EC2 instances, allowing you to control the incoming and outgoing traffic based on specified rules. They operate at the instance level and provide the necessary control over network traffic.

Network Access Analyzer helps identify and analyze the access permissions and configurations of AWS resources, but it does not control traffic directly. It is more focused on security auditing rather than traffic management.

VPC endpoints allow private connections between VPCs and supported AWS services without requiring public IP addresses. While they enhance connectivity, they do not directly control network traffic at the instance level.