A company has a strict compliance requirement that Amazon EC2 instances in a private subnet must only be able to access a specific Amazon S3 bucket. The instances must not have access to the internet. How can a solutions architect meet this requirement MOST securely?

Deploy a NAT gateway in a public subnet. Configure the S3 bucket policy to only allow traffic from the NAT gateway's Elastic IP.

Create a VPC gateway endpoint for S3. Attach an endpoint policy that allows access only to the specific S3 bucket.

Create a VPC interface endpoint for S3. Configure the security group on the endpoint to only allow traffic to the specific S3 bucket.

Set up an AWS Site-to-Site VPN to route traffic to the S3 bucket through the corporate network.