A solutions architect must connect the corporate network to a VPC so on-premises systems can access AWS resources. The solution must encrypt all traffic between the corporate network and the VPC at the network and session layers, and must enforce security controls to prevent unrestricted access. Which solution meets these requirements?

AWS Site-to-Site VPN encrypts traffic at the network and session layers, fulfilling the encryption requirement. Route table entries direct traffic, and security groups/network ACLs enforce security controls by allowing only required traffic, preventing unrestricted access. AWS Direct Connect provides a dedicated private connection but doesn't inherently encrypt traffic at the network/session layers; encryption would require an additional VPN over Direct Connect. IAM policies control access to the AWS Management Console and services, not network connectivity or traffic encryption between on-premises and a VPC. AWS Transit Gateway facilitates network connectivity between multiple VPCs and on-premises networks but doesn't inherently provide the required encryption; it would typically be used in conjunction with a VPN.