A company has separate AWS accounts for multiple business units. Each business unit manages its own network with several VPCs that use overlapping CIDR ranges. The marketing team built a new internal application and wants it reachable from the other business units using private IP addresses only. Which solution accomplishes this with the LEAST operational overhead?

AWS PrivateLink is the most suitable solution due to its ability to provide private connectivity between VPCs without requiring VPC peering, VPNs, or exposing traffic to the public internet, even with overlapping CIDR ranges. By creating an endpoint service for the marketing application and allowing other accounts to create interface VPC endpoints, PrivateLink establishes a private, one-way connection. This avoids the complexities of managing overlapping CIDRs, which VPC peering cannot handle directly. The other options are less efficient: requiring unique secondary CIDRs is operationally intensive and doesn't fully solve the overlapping CIDR issue for direct peering. Using an EC2 virtual appliance with Site-to-Site VPN introduces significant management overhead and potential performance bottlenecks. An API Gateway with NLB is designed for API exposure, not general application access via private IPs, and adds unnecessary layers for internal communication.