A data lake stored in an S3 bucket must be accessible to hundreds of applications across many AWS accounts. Policy requires that the S3 bucket not be reachable over the public internet, and each application must have least-privilege access. A solutions architect plans to use S3 access points restricted to specific VPCs for each application. Which combination of actions should the architect take to implement this? (Choose two.)

The first correct option describes creating S3 Access Points, which are a key component for managing granular access to S3 buckets from multiple applications and VPCs. By creating an Access Point for each application and restricting it to that application's VPC, least-privilege access is enforced. The bucket policy update ensures all requests must use an Access Point, preventing direct public internet access to the bucket. The second correct option details creating a Gateway Endpoint for S3 in each application's VPC. Gateway Endpoints provide private connectivity to S3 from within a VPC without traversing the internet, aligning with the requirement that the bucket not be reachable over the public internet. The endpoint policy further restricts access to the specific S3 Access Point, reinforcing security. Incorrect options: Creating an interface endpoint for S3 is incorrect because Gateway Endpoints are used for S3, not interface endpoints. Creating S3 Access Points in each AWS account and attaching them to the S3 bucket is incorrect because S3 Access Points are created within the same AWS account as the S3 bucket. Creating a gateway endpoint in the data-lake VPC is insufficient as each application's VPC needs its own endpoint for private connectivity.