A global company processes sensitive PII via an internal portal hosted in a corporate data center connected to AWS over AWS Direct Connect. The application stores PII in Amazon S3, and policy requires that traffic between the portal and S3 must not traverse the public internet. What should the SysOps administrator implement to ensure S3 traffic remains on AWS private networks?

Creating an interface VPC endpoint for Amazon S3 ensures that traffic between your on-premises data center (connected via Direct Connect) and S3 remains entirely within the AWS private network, never traversing the public internet. This meets the security requirement for sensitive PII. Interface endpoints are powered by AWS PrivateLink, providing private connectivity to AWS services. The application must be updated to use the endpoint's DNS name. Deploying AWS Network Firewall or adding VPC network ACLs cannot rewrite traffic to an "internal S3 address" in a way that bypasses the public internet for S3 access; these are primarily for traffic filtering and inspection. Modifying the application to use S3 path-style addressing is a way to access S3 buckets, but it does not inherently guarantee private network access or prevent traffic from traversing the public internet.