A gateway endpoint for S3 is added to a VPC, but one private subnet still sends S3 traffic through NAT. What configuration is most likely missing?

1. Create a Transit Gateway attachment for the S3 bucket.
2. Associate the gateway endpoint with the route table used by that subnet.
3. Add a public IP address to the private instance.
4. Add an inbound security group rule directly to the gateway endpoint.