An Amazon EC2 Instance in a Private Subnet Needs to Copy

Multiple Choice

An Amazon EC2 instance in a private subnet needs to copy data to an Amazon S3 bucket. For security reasons, the connection from the EC2 instance to Amazon S3 must not traverse across the Internet. What action should the SysOps Administrator take to accomplish this?

A) Create a NAT instance and route traffic destined to Amazon S3 through it.
B) Create a VPN connection between the EC2 instance and Amazon S3.
C) Create an S3 VPC endpoint in the VPC where the EC2 instance resides.
D) Use AWS Direct Connect to maximize throughput and keep the traffic private.