A business unit needs a private partner TCP service. The partner and customer use overlapping CIDRs, and neither wants broad network connectivity. Which design is best?

1. Propagate both identical ranges into the same Transit Gateway table.
2. Publish the service on the internet and rely only on a hard-to-guess hostname.
3. Peer the overlapping VPCs and advertise all subnets.
4. Expose the service through PrivateLink with approved consumer principals and endpoint connection control.