A company built APIs using Amazon API Gateway with Regional endpoints. These APIs invoke AWS Lambda functions and use API Gateway authentication. A review found a subset of APIs that must not be publicly accessible and should be callable only from within a VPC. All calls must be from authenticated users. Which solution accomplishes this with the least effort?

Changing the API Gateway endpoint type to Private and creating an interface VPC endpoint (AWS PrivateLink) ensures the APIs are accessible only from within the specified VPC. A resource policy on the API Gateway further restricts access to only calls originating from the VPC endpoint, meeting the requirement for non-public accessibility and authenticated calls. This is the most direct and secure method for restricting API Gateway access to a VPC. Incorrect options: Using an ALB and pointing to Lambda functions would require re-architecting the API Gateway integration and authentication, increasing effort. Removing the API Gateway DNS entry and using Route 53 CNAME does not restrict access to a VPC; it only changes the DNS resolution. Deploying Lambda functions inside a VPC and using an EC2 instance with Apache introduces unnecessary infrastructure and complexity, deviating significantly from the existing API Gateway setup.