A company has a working Direct Connect path between its data center and AWS. An audit now requires IPsec encryption for traffic on that path. The company wants to retain Direct Connect connectivity. Which approach meets the requirement?

1. Enable S3 default encryption to encrypt all packets crossing the Direct Connect circuit.
2. Use the existing private virtual interface alone, because a private circuit automatically applies IPsec encryption.
3. Implement a supported Site-to-Site VPN over Direct Connect design with the required gateway and routing configuration.
4. Use only TLS for selected web requests and treat every non-HTTP protocol as encrypted.