An application that is hosted on Amazon EC2 instances needs to access an Amazon S3 bucket. Traffic must not traverse the internet. How should a solutions architect configure access to meet these requirements?

1. Create a private hosted zone by using Amazon Route 53.
2. Set up a gateway VPC endpoint for Amazon S3 in the VPC.
3. Configure the EC2 instances to use a NAT gateway to access the S3 bucket.
4. Establish an AWS Site-to-Site VPN connection between the VPC and the S3 bucket.