An operations engineer plans to launch a collection of Amazon EC2 instances. The instances will run a custom application which will be managed by operations users who are members of a group. The operations users should be granted access only to the custom application instances. Which actions should a security engineer take to control access? (Select TWO.)