An application will run on Amazon EC2 instances in private subnets across multiple Availability Zones in a VPC. The EC2 instances frequently access large, confidential files stored in Amazon S3 buckets for processing. The solutions architect must minimize data transfer costs. What should the architect do?

Creating a gateway endpoint for Amazon S3 in the VPC allows EC2 instances in private subnets to access S3 directly, without traversing the public internet or requiring a NAT Gateway. This significantly reduces data transfer costs because traffic to S3 through a gateway endpoint is free. Adding a route table entry for the gateway endpoint directs S3-bound traffic appropriately. A NAT Gateway enables instances in private subnets to initiate outbound connections to the internet but doesn't provide direct, cost-free access to S3 within the AWS network. Data transferred through a NAT Gateway incurs charges, making it a less cost-effective solution for S3 access. AWS PrivateLink (interface endpoint) for S3 is an option, but it incurs hourly and per-GB charges, whereas a gateway endpoint for S3 is free.