A company needs to call Amazon Bedrock APIs from within its AWS account without exposing data to the public internet. What solution satisfies both private connectivity and avoidance of internet exposure?

AWS PrivateLink is the correct solution because it allows you to establish private connectivity between your Amazon Virtual Private Cloud (VPC) and AWS services, like Amazon Bedrock, without exposing your traffic to the public internet. This ensures that API calls remain within the AWS network, satisfying both the private connectivity and internet exposure avoidance requirements. CloudFront is a content delivery network and does not provide private connectivity to AWS services. AWS Glue is an ETL service and not relevant for establishing private network connections. AWS Lake Formation is for data governance and security, not network connectivity.