A company has an Amazon EC2 instance in a private subnet. The company wants to initiate a connection to the internet to pull operating system updates while preventing traffic from the internet from accessing the EC2 instance. Which AWS managed service allows this? A. VPC endpoint B. NAT gateway C. Amazon PrivateLink D. VPC peering