The correct option is AWS PrivateLink. It enables private connectivity from a VPC to supported AWS services and third party services by using interface VPC endpoints so traffic does not traverse the public internet.

AWS PrivateLink provisions interface endpoints inside the VPC that expose the service on private IP addresses. This design keeps service-to-service calls on the AWS network rather than the public internet and it works with VPC routing and security groups to provide network level control over traffic.

IAM policies control which identities can call APIs and what actions they can perform but they do not create private network paths or stop traffic from traversing the public internet.

AWS Macie focuses on discovering and protecting sensitive data in Amazon S3 and it does not provide private endpoints or service connectivity.

AWS Config records resource configurations and evaluates compliance so it is an auditing and inventory tool and it does not deliver private service-to-service connectivity between a VPC and AWS service endpoints.

Full AWS Practitioner Certification Question