Correct answer: Create a gateway VPC endpoint for Amazon S3 in the Availability Zone where the EC2 instance is located. Attach appropriate security groups to the endpoint. Attach a resource policy to the S3 bucket to only allow the EC2 instances IAM role for access.

This solution ensures all traffic between the EC2 instance and the S3 bucket stays on the AWS private network, avoiding the public internet. A gateway VPC endpoint is the correct option for Amazon S3, and bucket policies can restrict access to only the specific IAM role associated with the EC2 instance.

Why the other options are incorrect:

Interface VPC endpoint: S3 uses gateway endpoints, not interface endpoints. Interface endpoints are used for services like SSM, Secrets Manager, etc.
nslookup to get S3 IP: Amazon S3 is a distributed system and does not provide a static IP that can be routed to in this way. This approach is unreliable and not recommended.
Using ip-ranges.json: IP ranges may change and do not provide control over routing paths. There is no guarantee that the data avoids the public internet using this method.

Key takeaway: For private and secure access to Amazon S3 from within a VPC, use a gateway VPC endpoint and restrict bucket access using IAM policies and bucket resource policies.

Full AWS Practitioner Certification Question