A VPC workload must reach S3 without internet egress. Which configuration provides a private service path while preserving authorization controls?

1. Use an S3 gateway endpoint with selected route tables and appropriately scoped policies.
2. Use a public NAT gateway and treat the path as an endpoint policy.
3. Remove all bucket permissions because private routing grants access.
4. Publish a private-looking CNAME for the public S3 endpoint.