A company runs an application on Amazon EC2 instances in a private subnet. The application must process sensitive data from an Amazon S3 bucket without using the internet. Which solution meets these requirements?

A VPC endpoint allows private connectivity from your VPC to supported AWS services like S3 without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect. This ensures data remains within the AWS network, meeting the requirement for processing sensitive data without using the internet. The S3 bucket policy can then be configured to specifically allow access from the VPC endpoint, enhancing security. The application doesn't need modification to use the endpoint, as it transparently routes S3 requests. Incorrect options: An internet gateway provides internet access, which violates the "without using the internet" requirement. A VPN connection is for connecting your VPC to an on-premises network, not for private access to AWS services within the same region. A NAT gateway allows instances in a private subnet to initiate outbound connections to the internet, again violating the "without using the internet" requirement.