A team routes behavioral data for the company. The VPC design is Multi-AZ with public and private subnets, an internet gateway, and each public subnet contains a NAT gateway. Applications in private subnets read and write to Amazon Kinesis Data Streams. Cost Explorer shows consistently high EC2‑Other charges due to increasing NatGateway-Bytes costs. The solutions architect must reduce costs while preserving application functionality. What should the architect do?

The correct answer is to add an interface VPC endpoint for Kinesis Data Streams and ensure the VPC endpoint policy allows traffic from the applications. This is because Kinesis Data Streams is an AWS service, and an interface VPC endpoint allows private connectivity from your VPC to Kinesis Data Streams without traversing the internet or a NAT Gateway. This eliminates the data processing charges associated with NAT Gateways for Kinesis traffic, directly addressing the "NatGateway-Bytes" cost issue. The endpoint policy ensures authorized applications can use this private connection. The other options are incorrect because: Enabling VPC Flow Logs and analyzing them with Athena or Detective to block traffic might reduce costs if there's unnecessary traffic, but it doesn't address the fundamental design causing Kinesis traffic to incur NAT Gateway charges. Kinesis traffic is legitimate and needed. Simply adding an interface VPC endpoint without ensuring the endpoint policy allows traffic from the applications would prevent the applications from using the endpoint, breaking functionality. While IAM permissions are also crucial, the endpoint policy specifically controls access to the endpoint itself.