An application in a private subnet needs to access an Amazon DynamoDB table. Traffic must not traverse the public internet. The security team requires that the application can ONLY access one specific DynamoDB table. How should this be implemented?

Create a NAT Gateway and use an IAM policy on the EC2 instance to restrict access.

Create an Interface VPC Endpoint for DynamoDB and use Security Groups to restrict access.

Create a Gateway VPC Endpoint for DynamoDB and attach an endpoint policy that allows access only to the specific table.

Set up AWS Direct Connect to route traffic securely to DynamoDB.