A dataset stored in Amazon S3 contains PII and must meet these requirements: it must only be reachable from a specific VPC and it must not traverse the public internet. How can you meet these constraints?

Creating a VPC endpoint (specifically a Gateway Endpoint for S3) allows instances within your VPC to access S3 without traversing the public internet, fulfilling the "not traverse the public internet" requirement. Attaching an S3 bucket policy that explicitly restricts access to this specific VPC endpoint and its VPC ensures that only resources originating from that authorized VPC can reach the data, meeting the "only reachable from a specific VPC" constraint and protecting PII. The other options are incorrect because: "Grants access to the VPC endpoint and to an EC2 instance" is too broad; the policy needs to restrict, not just grant, and the EC2 instance itself isn't the primary restriction mechanism. "Configure Network ACLs to allow traffic only between that VPC endpoint and an EC2 instance" is insufficient. While NACLs add a layer of security, they don't prevent S3 access from outside the VPC if the bucket policy allows it. The S3 bucket policy is the primary control for S3 access. "Rely on security groups to restrict access to the VPC endpoint and an EC2 instance" is also insufficient for similar reasons to NACLs. Security groups control instance-level traffic, but the S3 bucket policy is crucial for controlling who can access the S3 bucket itself.