How would you design a secure multi-tenant architecture in a public cloud environment like AWS or Azure to prevent lateral movement?