Private S3 Access Patterns

Design and implement private S3 access patterns for a secure VPC architecture. Create a VPC with private subnets (no internet gateway) and deploy an EC2 instance with no public IP address. Configure an S3 Gateway VPC endpoint with least-privilege endpoint policies restricting access to a specific bucket. Add an S3 Interface endpoint (PrivateLink) to compare the two access patterns side by side. Enable VPC Flow Logs to CloudWatch for network traffic visibility. Query endpoint traffic using CloudWatch Logs Insights and build a comprehensive CloudWatch dashboard showing network traffic, instance health, and flow log data. Covers SAP-C02 Domain 1 (Design Secure Architectures) with emphasis on VPC endpoint selection, private subnet design, and network traffic monitoring.