An ECS cluster on EC2 will no longer have internet access; NAT gateways and the internet gateway must be removed. ECS tasks must still pull images from private ECR repos and from a public ECR registry. Public images must be refreshed so new versions are available to the cluster within 24 hours. Which combination of steps (choose three) provides the required functionality with minimal operational overhead?

To allow ECS tasks to pull images from private ECR repositories without internet access, an ECR interface VPC endpoint is required. This endpoint provides private connectivity from your VPC to ECR. For public ECR registries, an ECR pull-through cache rule is the most efficient solution. This rule caches public images in your private ECR, allowing ECS tasks to pull them without direct internet access. Pre-pulling images through the cache ensures they are available before internet access is removed. Finally, an S3 gateway endpoint is necessary because ECR uses S3 for image storage. Without it, even with the ECR endpoint, image layers cannot be retrieved. The option involving CodeBuild and private repos is overly complex and incurs higher operational overhead. The option to create a new ECR pull-through cache rule for each public image is less efficient than a single rule for the entire public registry. Creating an ECR interface VPC endpoint for public ECR repositories is incorrect; pull-through cache handles public registries.