A company stores IoT data in an Amazon S3 data lake. Data scientists run analytics on EC2 instances in public subnets of a VPC in a different AWS account; these EC2 instances already have an IAM role permitting S3 access. Company policy requires only authorized networks may access IoT data. Which combination of steps should a solutions architect implement to meet these requirements? (Choose two.)

To meet the requirement of restricting S3 access to authorized networks (the data scientists' VPC), S3 Access Points are the most suitable solution. First, creating an S3 Access Point in the data scientists' AWS account that references the S3 data lake bucket allows granular control over access from that specific VPC. Second, adding an S3 bucket policy to the data lake bucket that permits s3:GetObject only when the s3:DataAccessPointArn condition key matches the ARN of the newly created Access Point ensures that all access to the data lake must flow through this authorized Access Point. Creating a gateway VPC endpoint for S3 is unnecessary because Access Points handle network access. Updating the EC2 instance role with an s3:DataAccessPointArn condition is not sufficient on its own; the bucket policy is crucial for enforcement. Modifying the VPC route table for S3 traffic to an Access Point is not how Access Points are integrated; they are accessed via their own DNS names.