A company runs microservices on EC2 instances in multiple Availability Zones behind an ALB. A new REST API was built in Amazon API Gateway. Some legacy microservices running on EC2 need to call the new API, but the company requires that the API not be exposed to the public internet and that traffic not traverse the public internet. What should a solutions architect do to satisfy these constraints?

The correct solution involves creating an interface VPC endpoint for API Gateway. This allows private connectivity from your VPC to API Gateway without traversing the public internet, satisfying the core requirement. Setting the API Gateway endpoint type to Private ensures it's only accessible via the VPC endpoint. An endpoint policy on the VPC endpoint and a resource policy on the API Gateway further restrict access to the specific API and VPC endpoint, enhancing security. Incorrect options: Site-to-Site VPN is for connecting on-premises networks to AWS, not for inter-service communication within AWS. IAM authentication is a good security practice but doesn't address the private connectivity requirement. Moving API Gateway to a new VPC and using Transit Gateway is overly complex and doesn't inherently make the API private from the internet; it still needs a private endpoint. Global Accelerator is for improving performance and availability over the public internet, not for private, non-internet-facing access.