To enable an EC2 instance within a VPC to access a private API Gateway REST API, you must create an interface VPC endpoint for API Gateway (execute-api). Enabling private DNS on this endpoint is the standard practice; it allows applications to use the API's public DNS name, which will resolve to the endpoint's private IP addresses within the VPC. The API's resource policy must be updated to explicitly grant access from the source VPC or VPC endpoint. Finally, the VPC endpoint policy should grant the execute-api:Invoke permission, following the principle of least privilege to allow the API to be called through the endpoint.

A. Disabling private DNS is not the recommended approach as it requires using the endpoint-specific DNS name, complicating configuration and potentially requiring code changes. The apigateway: permission is overly permissive.
C. A VPC Link is used for the opposite traffic flow: it allows API Gateway to integrate with private backend resources (like an NLB) within a VPC, not for clients to access the API.
D. Similar to option C, a VPC Link is for private backend integrations. The scenario requires a client in a VPC to invoke the API, not for the API to invoke a backend ALB. ---

1. AWS API Gateway Developer Guide, "Creating a private API in Amazon API Gateway": This document outlines the required steps. It states, "To allow your API clients to access your private API through the interface endpoint, you must create a resource policy and attach it to the API." It also explains, "If you enable private DNS, you can access your private API using a private DNS name..."

2. AWS API Gateway Developer Guide, "Use VPC endpoint policies for private APIs in API Gateway": This guide specifies the permissions needed. It provides an example policy and states, "The following example policy allows access to the specified API... with the execute-api:Invoke action." This confirms the correct, least-privilege action.

3. AWS VPC User Guide, "Access an AWS service using an interface VPC endpoint": This document details the function of private DNS. Under the "Private DNS for interface endpoints" section, it explains that when enabled, "you can make requests to the service using its default DNS hostname... instead of using the VPC endpoint-specific DNS hostnames." This supports the seamless integration described in the correct answer.