A company runs a PaaS-managed object storage service and an application on virtual machines inside a private subnet within a VPC. Currently, application traffic to the storage service routes over the public internet through a NAT gateway, incurring egress data-processing charges and raising security concerns because the data leaves the provider's private backbone. The architect wants the VMs to reach the managed storage service using the cloud provider's internal network without exposing traffic to the internet. Which design should the architect implement?