A company is connecting 80 VPCs across accounts and an on-premises network. Production and development must remain isolated, but both need shared DNS services. Which design best avoids a full mesh while enforcing these routing boundaries?

1. Use one internet gateway as a private routing hub across all accounts.
2. Associate every attachment with one table and propagate every route to it.
3. Peer every VPC with a central VPC and use it to transit traffic to all other peers.
4. Use Transit Gateway with separate route tables and deliberate shared-services propagation.