A company operates a static content distribution platform serving customers around the world. Customers consume content from their own AWS accounts. The content is hosted in an Amazon S3 bucket. The company uploads content from on-premises to S3 using an S3 File Gateway. The company wants to improve performance and reliability by serving content from the AWS Region geographically closest to each customer. On-premises data must be routed to Amazon S3 with minimal latency and without using the public internet. Which combination of steps achieves these goals with the least operational overhead? (Choose two.)

S3 Multi-Region Access Points provide a single global endpoint to access data across multiple S3 buckets in different AWS Regions. This simplifies architecture and improves performance by routing requests to the nearest bucket with the lowest latency, aligning with the goal of serving content from the geographically closest Region. AWS PrivateLink allows private connectivity between VPCs and AWS services, while AWS Direct Connect provides a dedicated network connection from on-premises to AWS. Combining these ensures that on-premises data is routed to Amazon S3 with minimal latency and without using the public internet, fulfilling the requirement for secure and performant data transfer. S3 Cross-Region Replication (CRR) is a component of Multi-Region Access Points but doesn't provide the single global endpoint or simplified access on its own. An AWS Lambda function for routing adds operational overhead and complexity that Multi-Region Access Points already address. An AWS Site-to-Site VPN uses the public internet and doesn't offer the same low latency or dedicated connectivity as Direct Connect.