You Are Deploying an EC2 Instance in a Private Subnet

You are deploying an EC2 instance in a private subnet that requires access to the Internet. One of the requirements for this solution is to restrict access to only particular URLs on a whitelist. In addition to the whitelisted URLs, the instances should be able to access any Amazon S3 bucket in the same region via any URL. Which of the following solutions should you deploy? (Choose two.)

A) Include s3.amazonaws.com in the whitelist.
B) Create a VPC endpoint for S3.
C) Run Squid proxy on a NAT instance.
D) Deploy a NAT gateway into your VPC.
E) Utilize a security group to restrict access.