Advanced AI Prompt for Private EKS Cluster Endpoint Security

Act as an AWS Network Security Architect. Design an air-gapped, completely private EKS cluster architecture with absolutely zero public internet footprint. Provide the Terraform HCL defining the `aws_eks_cluster` with `endpoint_public_access = false` and `endpoint_private_access = true`. Architect the mandatory AWS PrivateLink Interface VPC Endpoints required for ECR, S3, EC2, and STS to allow the worker nodes to pull images and authenticate without a NAT Gateway. Establish secure API connectivity by routing `kubectl` traffic from a centralized management VPC ([MANAGEMENT_VPC_CIDR]) across the [TRANSIT_GATEWAY_ID]. Write the strict Security Group ingress rules attached to the EKS control plane ENI, permitting API access exclusively from the [BASTION_HOST_ID] and the corporate VPN [WHITELISTED_IPS].