Advanced AI Prompt for AWS VPC Endpoint Policy for S3

Act as an AWS Network Security Specialist. Draft a strict VPC Endpoint Policy (Gateway Endpoint) for Amazon S3. The policy must exclusively allow traffic originating from the VPC [VPC_ID] to access the specific target bucket [BUCKET_NAME]. Crucially, it must implement a hard `Deny` statement blocking any S3 requests that do not originate from the trusted organization account [ALLOWED_ACCOUNT_ID]. Detail how this specific combination of `aws:PrincipalAccount` and `aws:SourceVpc` conditions effectively prevents data exfiltration, ensuring that even if a malicious actor inside the VPC possesses valid AWS credentials for an external account, they cannot extract data to an external S3 bucket via this endpoint.