A company wants S3 access restricted to requests using its approved VPC endpoint. Which bucket-policy design needs particular care?

1. Replace the bucket policy with a DNS record for the endpoint.
2. Allow every principal whenever the bucket name contains private.
3. Use an aws:SourceVpce condition and account for approved administrative and AWS-service access paths.
4. Trust an HTTP header named VPC-Endpoint supplied by the client.