You have a Cloud Storage bucket in Google Cloud project XYZ. The bucket contains sensitive data. You need to design a solution to ensure that only instances belonging to VPCs under project XYZ can access the data stored in this Cloud Storage bucket. What should you do?

A. Configure Private Google Access to privately access the Cloud Storage service using private IP addresses. B. Configure a VPC Service Controls perimeter around project XYZ, and include storage.googleapis.com as a restricted service in the service perimeter. C. Configure Cloud Storage with projectPrivate Access Control List (ACL) that gives permission to the project team based on their roles. D. Configure Private Service Connect to privately access Cloud Storage from all VPCs under project XYZ.