A company has a multi-tier web application whose internal services run on EC2 and need to call third-party SaaS APIs hosted on AWS. The company requires secure, private connectivity with minimal public internet exposure. Which solution meets these requirements?

AWS PrivateLink provides private connectivity between VPCs and services hosted on AWS, including third-party SaaS APIs, without exposing traffic to the public internet. It creates an endpoint in your VPC that connects directly to the service, ensuring secure, private communication. This meets the requirement for minimal public internet exposure and secure, private connectivity. Implementing an AWS Site-to-Site VPN is for connecting on-premises networks to AWS, not typically for connecting to SaaS providers within AWS. Deploying AWS Transit Gateway is for interconnecting multiple VPCs and on-premises networks, but doesn't inherently provide private connectivity to a third-party SaaS provider without additional services like PrivateLink. Configuring AWS PrivateLink to allow only outbound traffic is a partial description; PrivateLink establishes a full private connection, not just outbound.