EC2 workers in private subnets upload large amounts of data to S3 buckets in the same Region. All S3 traffic currently passes through NAT gateways. The company wants to avoid NAT processing charges for this traffic without making the workers public. Which TWO changes best meet the requirement? (Choose TWO.)

1. Assign public IPv4 addresses to the workers and retain all existing NAT routes.
2. Associate the endpoint with the workers' route tables and ensure endpoint and bucket policies permit the intended S3 operations.
3. Create a Secrets Manager interface endpoint and assume it routes all S3 traffic.
4. Remove every default route without adding any S3 route or endpoint.
5. Create an S3 gateway VPC endpoint for the VPC.