A company runs an AWS Lambda function in private subnets in a VPC. The subnets use a default route to the internet through an Amazon EC2 NAT instance. The Lambda function processes data and saves output to Amazon S3. Intermittently, the Lambda times out while uploading because the NAT instance's network is saturated. The company wants the Lambda to access Amazon S3 without traversing the internet. Which solution meets these requirements?

The correct solution is to provision a gateway endpoint for Amazon S3 and update the route tables. A gateway endpoint provides private connectivity from your VPC to S3 without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect. This eliminates the dependency on the NAT instance for S3 traffic, resolving the saturation issue and ensuring direct, private access. Replacing the EC2 NAT instance with a managed NAT Gateway or increasing the NAT instance size would address the saturation but still route S3 traffic through a NAT device, which is not the most efficient or private solution for S3. A transit gateway is used for connecting multiple VPCs and on-premises networks, not for private access to AWS services within a single VPC.