title: Connect to AWS s3 from on-premise via site-to-site VPN
body: <p>We have a hybrid model with on-premise connected to AWS via a site-to-site VPN. There is a need to download data from s3 to on-premise in a way that the traffic will go from on-premise to AWS and back without going to the open Internet for security considerations. I.e. similar to this:
  <code>on-prem --VPN--&gt; AWS private subnet --&gt; s3 endpoint --&gt; s3</code></p>
  <p>This schema works with interface endpoints since they generate private DNS names which can be used to call from on-premise, but the s3 endpoint is a gateway endpoint, not an interface endpoint, so it doesn't generate private DNS names.</p>
  <p>How can this be achieved?</p>