EC2 instances are in a private subnet and must access S3 buckets in the same Region. No changes are allowed to the instances or application, and the instances must not have internet access. Which approach satisfies these constraints?

A gateway VPC endpoint for S3 is the correct solution because it allows instances in a private subnet to access S3 buckets directly from within the AWS network without requiring an internet gateway, NAT gateway, or public IP addresses. This satisfies the requirement that instances must not have internet access and no changes to instances or applications are allowed. An S3 interface endpoint is incorrect because it is for accessing S3 through a private IP address within your VPC, but a gateway endpoint is specifically designed for S3 and DynamoDB and is more appropriate here. A NAT gateway provides internet access, which violates the constraint. A proxy EC2 instance would require changes to the application or instance configuration to route traffic through it, which is not allowed.