A financial services company runs a data-analytics application in an on-premises data center connected to AWS via an existing Direct Connect private VIF and a Direct Connect gateway. The security team mandates that traffic to Amazon S3 for storing regulatory reports must never traverse the public internet and must not require adding public IP prefixes to the Direct Connect public VIF. Which AWS connectivity construct should the network architect deploy to reach the S3 service privately over the existing private connectivity?