A Company Has an Application Hosted on Amazon EC2 Instances

A company has an application hosted on Amazon EC2 instances in two VPCs across different AWS Regions. To communicate with each other, the instances use the internet for connectivity. The security team wants to ensure that no communication between the instances happens over the internet. What should a solutions architect do to accomplish this?

A) Create a NAT gateway and update the route table of the EC2 instances' subnet.
B) Create a VPC endpoint and update the route table of the EC2 instances' subnet.
C) Create a VPN connection and update the route table of the EC2 instances' subnet.
D) Create a VPC peering connection and update the route table of the EC2 instances' subnet.