Security groups

NAT gateways

Virtual private gateway

Gateway VPC endpoints

Create an Amazon CloudWatch Events for file restoration from Amazon S3 Glacier using the GlacierJobDescrbption API and send the event to an SNS topic the administrator has subscribed to.

Create an AWS Lambda function that perform a HEAD request on the object being restored and checks the storage class of the object. Then send a notification to an SNS topic the administrator has subscribed to when the storage class changes to STANDARD.

Enable an Amazon S3 event notification for the s3: ObjectCreated : Post event that a sends notification to an SNS topic the administrator has subscribed.

Enable S3 event notification for the S3: ObjectRestore: Completed event that sends a notification to an SNS topic the Administrator has subscribed to.

Create a customer gateway to connect to Amazon S3 Modify the route table of the private subnets to use the customer gateway

Create a gateway VPC endpoint for Amazon S3 Modify the route table of the private subnets to use the gateway VPC endpoint.

Create a NAT gateway in the private subnets. Modify the route table of the subnets to use the NAT gateway.

Create an S3 bucket policy to allow connections from the private subnets. Modify the route table.