A company runs an application on Amazon EC2 behind an Application Load Balancer. The application also uses Amazon S3 and Amazon SQS and scales with AWS Auto Scaling. The security policy mandates least-privilege access, which is already enforced on existing resources. A security engineer must establish private connectivity from the application to these AWS services. Which combination of actions will satisfy this requirement? (Choose three.)

To establish private connectivity to Amazon SQS, an interface VPC endpoint is required. SQS supports interface endpoints (powered by AWS PrivateLink), allowing traffic to remain within the AWS network. For Amazon S3, a gateway VPC endpoint is the correct choice. Gateway endpoints provide private connectivity to S3 and DynamoDB from within a VPC. To enforce least privilege, the policies on these VPC endpoints must be edited to restrict access to only the specific SQS queues and S3 buckets the application uses. This prevents unauthorized access to other resources through the endpoint. Connecting to S3 via AWS Transit Gateway or AWS Firewall Manager is incorrect; Transit Gateway is for inter-VPC or on-premises connectivity, and Firewall Manager manages firewalls, not private service access. Updating the IAM role for outbound traffic to interface endpoints is not necessary; IAM roles define permissions for actions, not network routing.