Design Solutions for Organizational Complexity

Local Zones place compute/storage closer to large population centers (extending a parent Region); AWS Wavelength embeds infrastructure inside telco 5G networks for ultra-low mobile latency; Outposts run AWS hardware in your own data center for data residency and local processing. Each trades some service availability and management for proximity.

Use AWS Outposts (AWS hardware on-prem under your physical control), Local Zones within the jurisdiction if available, or a Dedicated Local Zone / AWS Sovereign Cloud where offered. Region selection itself is the first lever — choose a Region inside the legal boundary when one exists.

Peering connects exactly two VPCs; traffic cannot route through an intermediary peered VPC to reach a third. A full mesh of N VPCs requires N(N-1)/2 connections, which becomes unmanageable, so Transit Gateway (hub-and-spoke) is preferred beyond a handful of VPCs.

VPC peering and Transit Gateway both reject overlapping CIDRs for routing. Use PrivateLink to expose specific services (no CIDR overlap concern, only the endpoint matters), or re-IP one VPC, or place a private NAT gateway to translate addresses across a TGW attachment.

PrivateLink exposes a single service behind a Network Load Balancer (or GWLB) as an endpoint service; consumers create interface endpoints. It is unidirectional, scales to many consumers without CIDR coordination, and exposes only that service — not the whole network. Peering/TGW give full bidirectional network reachability.

Association binds an attachment to exactly one TGW route table, determining which route table is used to look up routes for traffic entering from that attachment. Propagation injects an attachment's routes (its VPC CIDRs or BGP-learned routes) into a chosen route table automatically. The two are independent controls.