CVO replication IPs are transmitting to a public AWS bucket instead of private

• The CVO was not configured to us a VPN or AWS direct connect to communicate with a VPC endpoint that uses a private address.

To ensure S3 traffic remains private and does not traverse public AWS endpoints:

1. Create an S3 VPC Gateway Endpoint in the relevant AWS region for the VPC where the CVO instance resides.
2. Attach the VPC Gateway Endpoint to the subnet route table(s) used by the CVO instance.
3. No need to change the FabricPool object store server DNS—the VPC Gateway Endpoint will automatically intercept S3 traffic destined for the regional S3 URL and route it privately.
4. Verify that after the endpoint is in place, new connections from the CVO cluster to S3 use private 10.x.x.x IP addresses instead of public IPs.