EC2 instances in private subnets must retrieve Secrets Manager secrets. The VPC has no internet gateway or NAT gateway. DNS support is enabled. Which configuration provides private service access without adding an internet route?

1. Create a Secrets Manager interface VPC endpoint, enable private DNS, and allow HTTPS from the instance security group to the endpoint security group.
2. Create a gateway VPC endpoint for Secrets Manager and associate it with the private route tables.
3. Create a Route 53 private hosted zone but do not deploy an endpoint.
4. Add a default route to an internet gateway while leaving all instances without public addresses.