An organization is planning to setup a management network on the AWS VPC. The organization is trying to secure the webserver on a single VPC instance such that ...

An organization is planning to setup a management network on the AWS VPC. The organization is trying to secure the webserver on a single VPC instance such that it allows the internet traffic as well as the back-end management traffic. The organization wants to make so that the back end management network interface can receive the SSH traffic only from a selected IP range, while the internet facing webserver will have an IP address which can receive traffic from all the internetIPs.
How can the organization achieve this by running web server on a single instance?