A Glue job must read a database in private VPC subnets. The database should remain inaccessible from the public internet. Which configuration is appropriate?

1. Grant the Glue role database credentials but leave the network path to the private database blocked.
2. Configure the Glue connection for the appropriate VPC and subnet, allow the required security-group traffic, and provide access to needed AWS service endpoints or egress paths.
3. Make the database public and open its port to the entire internet as the only way Glue can connect.
4. Configure only the database hostname in catalog metadata and omit the required VPC connection and network permissions.