DataMosaic’s analytics platform runs in private subnets with no NAT gateways. Jobs must download data from Amazon S3 and call a partner’s API hosted in the partner’s AWS account without traversing the public internet. The solution must scale across hundreds of subnets with minimal ops overhead. Which actions should the networking team take? (Choose two.)

To access Amazon S3 from private subnets without a NAT Gateway or public internet, a Gateway VPC endpoint for S3 is the correct solution. This provides private connectivity to S3 within the AWS network, and routing tables in the private subnets must be updated to direct S3 traffic to this endpoint. For the partner's API, which is in another AWS account and must not traverse the public internet, AWS PrivateLink with interface VPC endpoints is the ideal choice. PrivateLink allows private, secure, and scalable connections between VPCs or services across different accounts without exposing traffic to the internet. VPC peering would require managing overlapping CIDR ranges and doesn't inherently provide private access to a specific service like PrivateLink does. Using an Internet Gateway and NAT Gateways would expose traffic to the public internet, violating a core requirement. Direct Connect is for on-premises connectivity, not for inter-VPC communication within AWS.