It depends whether the EC2 instance and S3 bucket are in the same region or not.

All communication between regions is across the public Internet.

You can read more about AWS regions and availability zones here. Communication within the same region happens over low-latency private links:

Availability Zones are connected to each other with fast, private fiber-optic networking.

See AWS Global Infrastructure.

EDIT

Although data transfer happens over private links within the same region, accessing the API endpoints using the SDK or CLI still requires Internet access. See AWS Regions and Endpoints.

If you're concerned about security in Java SDK, the default client configuration is to use HTTPS for all requests for increased security. (Although individual clients can also override this setting by explicitly including the protocol as part of the endpoint URL when calling AmazonWebServiceClient.setEndpoint(String))

If you're concerned about data transfer cost, all inbound traffic from S3 to EC2 is free of charge.