app runs in private-a. This VPC has no NAT gateway; interface endpoints let Session Manager reach the instance anyway. The catalogue is in the bucket market-assets-1d8mv5s.

1. Keep app's id in ID and start a session with it. Inside it, try the bucket, then exit:

   sh

   copy

   aws s3 ls s3://market-assets-1d8mv5s

2. Keep the VPC's id in VPC, and the private table's id in RT:

   sh

   copy

   RT=$(aws ec2 describe-route-tables --filters Name=tag:Name,Values=private --query "RouteTables[0].RouteTableId" --output text)

3. Give the private subnets a path to S3 that needs no NAT gateway.

4. Start a session with app again, copy the catalogue to /tmp/catalogue.json on the instance, then exit.