A Direct Connect connection must carry private VPC routes and public AWS API routes with separate logical routing. Which implementation is appropriate?

1. Advertise all private RFC 1918 VPC routes over a public VIF as a private transit replacement.
2. Put both routing domains on an untagged interface without configuring VIFs.
3. Use an S3 endpoint policy to split BGP sessions on the circuit.
4. Configure the appropriate private or transit VIF and a separate public VIF.