A company operates a batch-processing system that uses Amazon S3, Amazon EC2, and AWS Key Management Service (AWS KMS) across two AWS accounts. Account A hosts an S3 bucket for input and output objects, encrypted with a KMS key in Account A. Account B hosts a VPC with EC2 instances that access the S3 bucket via a bucket policy. The VPC has DNS hostnames and DNS resolution enabled. The company must redesign the system without code changes so that no AWS API calls from the EC2 instances traverse the internet. Which combination of steps meets these requirements? (Choose two.)

To ensure no AWS API calls traverse the internet, VPC endpoints are necessary. For Amazon S3, a gateway VPC endpoint is the correct choice as it provides private connectivity to S3 from within a VPC without requiring an internet gateway, NAT device, or VPN connection. The endpoint policy must grant the necessary S3 permissions. For AWS KMS, an interface VPC endpoint is required. Interface endpoints provide private connectivity to AWS services powered by AWS PrivateLink. Enabling Private DNS for the KMS interface endpoint ensures that DNS queries for KMS service endpoints resolve to the private IP addresses of the endpoint, keeping traffic within the AWS network. Disabling Private DNS would require manual DNS configuration or could lead to traffic traversing the internet.