A company runs its legacy web application on AWS. The web application server runs on an Amazon EC2 instance in the public subnet of a VPC. The web application server collects images from customers and stores the image files in a locally attached Amazon Elastic Block Store (Amazon EBS) volume. The image files are uploaded every night to an Amazon S3 bucket for backup. A solutions architect discovers that the image files are being uploaded to Amazon S3 through the public endpoint. The solutions architect needs to ensure that traffic to Amazon S3 does not use the public endpoint. Which solution will meet these requirements?

A gateway VPC endpoint for S3 allows instances in your VPC to access S3 privately, without traversing the public internet. By configuring the subnet route table to direct S3 traffic through this endpoint, the EC2 instance will use private AWS network paths. Moving the S3 bucket inside the VPC is incorrect because S3 is a global service, not deployed within a specific VPC. An S3 access point provides granular permissions but doesn't change the network path; it still uses public endpoints by default unless a VPC endpoint is also configured. AWS Direct Connect provides a dedicated connection from an on-premises network to AWS, but the EC2 instance is already in AWS, so it's not relevant for internal AWS traffic optimization.