An application runs in a private subnet and already uses Amazon Cognito with a user pool for authentication. The application needs to securely store user documents in an Amazon S3 bucket. Which combination of steps will securely integrate Amazon S3 with the application? (Choose two.)

To securely store user documents in S3 from an application in a private subnet using Cognito for authentication, you need two main components. First, an Amazon Cognito identity pool is necessary. While a user pool handles authentication, an identity pool provides temporary AWS credentials (including S3 access tokens) to authenticated users, allowing them to directly access AWS services like S3. Second, an Amazon S3 VPC endpoint is crucial for secure and private connectivity. This allows the application in the private subnet to access S3 without traversing the public internet, enhancing security and performance. The option to use only the existing user pool is incorrect because user pools primarily handle authentication, not authorization for AWS services like S3. A NAT gateway would allow outbound internet access but doesn't provide private S3 connectivity or the necessary S3 access tokens. Denying requests not initiated from Cognito is not a standard or effective S3 bucket policy for user-specific access. Allowing access only from users' IP addresses is impractical and insecure, as IP addresses can change and are not a reliable form of user authentication for S3.