Create an S3 bucket policy that allows access only from the private subnet ' s IP range. Configure each EC2 instance to use access keys that are stored in AWS Systems Manager Parameter Store. Configure Amazon S3 server access logging.

Create an IAM role that has access to the S3 bucket. Attach the IAM role to the EC2 instances. Update the bucket policy to allow access only for the role. Use AWS CloudTrail to log data events for the bucket.

Create an IAM user, an access key, and a secret key. Store the keys in AWS Secrets Manager. Configure the EC2 instances to retrieve the keys. Use AWS CloudTrail management events to track bucket access.

Create a gateway VPC endpoint for Amazon S3. Update the S3 bucket policy to allow access only through the endpoint. Attach an IAM role to the EC2 instances that has appropriate S3 permissions. Use VPC Flow Logs to track VPC endpoint activity.