A service reachable through PrivateLink must allow only approved consumer accounts to create endpoints and must require manual approval of new connections. What should be configured?

1. Allow every principal and disable acceptance because endpoint policies approve connections.
2. Attach the provider internet gateway to each consumer subnet.
3. Restrict allowed principals on the endpoint service and enable acceptance required.
4. Add the customer email addresses as Route 53 TXT records.