A company built a private REST API in Amazon API Gateway that on-prem clients must call over an existing AWS Direct Connect link. The engineer wants clients to reach the API endpoint via private connectivity without deploying additional infrastructure. Which option allows invoking the API without extra infrastructure?

The correct answer is to create an interface VPC endpoint for API Gateway with private DNS names enabled and access the API using the public DNS name of the endpoint. When private DNS is enabled on an interface VPC endpoint for API Gateway, AWS automatically resolves the public DNS names of regional API Gateway endpoints to the private IP addresses of the endpoint within your VPC. This allows on-premises clients connected via Direct Connect to resolve and access the API privately without needing to change the API's public DNS name or deploy additional infrastructure like Route 53 private hosted zones or custom DNS. Incorrect options: Using a Route 53 alias of the endpoint is not necessary because private DNS resolution handles the mapping automatically. Associating the endpoint with the private REST API is not a configuration option for interface VPC endpoints; the endpoint provides private access to the API Gateway service itself, not a specific API. Accessing the API by using the private DNS name of the endpoint would require clients to specifically use that name, which is not how private DNS integration with public API Gateway hostnames works.