In your application setup, the frontend is deployed on a managed instance group in subnet A, while the data layer resides on a MySQL Compute Engine virtual machine (VM) in subnet B within the same VPC. Both subnets also host several other Compute Engine VMs. Your goal is to restrict access so that only the application frontend can communicate with the MySQL instance on port 3306. What action should you take?