Instances currently launch in a public subnet and use a user-data script to download and install application artifacts from the internet. A new security classification requires the instances to have no internet access, and although instances launch healthy, the application is not installed. Which approach will install the application while ensuring no internet access?

The correct approach leverages AWS services to provide secure, private access to application artifacts without requiring internet access for the EC2 instances. Uploading artifacts to S3 and creating a VPC endpoint for S3 allows instances in a private subnet to download files directly from S3 over the AWS private network. An IAM instance profile grants the necessary S3 read permissions. Launching instances in a public subnet with Elastic IPs, installing, then disassociating EIPs temporarily grants internet access, violating the "no internet access" requirement. A NAT gateway provides outbound internet access, which contradicts the "no internet access" constraint for the instances themselves. Creating a security group with outbound access to the artifact repository also violates the "no internet access" rule, even if temporary.