How to access S3 interface endpoint from on-premises using Direct Connect?

Hello, we've set up a hosted Direct Connect connection that we want to use to upload files to an S3 bucket using an S3 interface endpoint which has private DNS enabled. However, we cannot seem to access the bucket from on-premises. We can reach the interface endpoint with ping (see below) but cannot establish a connection to place objects in the bucket.

We've taken a few steps to troubleshoot:

• The S3 interface endpoint's DNS name resolves to a private IP address in our subnet using dig *.vpce-def345-abc123.region.vpce.amazonaws.com +short
• We can ping an EC2 instance which is in the same subnet as the interface endpoint using its private IP address
• We can upload an object to the bucket from this EC2 instance using boto3 with a client like private_client = boto3.client(service_name="s3", region_name="region", endpoint_url="http://bucket.vpce-def345-abc123.region.vpce.amazonaws.com");. This implies there isn't an issue with the endpoint or bucket policy.
• When we ping the interface endpoint from on-premises, it is recorded in the flow logs associated with the interface endpoint's ENI, like 2 <my-aws-account-id> eni-123 <my-ip> <my-eni-private-ip> 0 0 1 5 420 1709659481 1709659541 ACCEPT OK
• The security group on the interface endpoint allows all outbound traffic (for debugging)
• The network ACL on the subnet in which we've placed the interface endpoint allows all outbound traffic (for debugging)
• The route table associated with the subnet has a route to send traffic destined for our on-premises network CIDR to the virtual private gateway