A financial institution runs an Amazon Bedrock-based AI application inside a VPC that is not allowed any Internet access for compliance reasons. Which AWS feature enables private access to Bedrock without exposing the VPC to the public Internet?

AWS PrivateLink allows you to establish private connectivity between your VPCs and AWS services like Amazon Bedrock, without exposing your VPC to the public internet. This is achieved by creating VPC endpoints for the service, which appear as elastic network interfaces (ENIs) with private IP addresses within your VPC. This ensures all traffic between your application and Bedrock remains within the AWS network, meeting compliance requirements for no internet access. Amazon Macie is a data security service, not a networking solution. Amazon CloudFront is a content delivery network (CDN) and would expose traffic to the internet. An Internet gateway provides internet access to a VPC, which is explicitly what the scenario aims to avoid.