Design Solutions for Organizational Complexity

Local Zones place compute/storage closer to large population centers (extending a parent Region); AWS Wavelength embeds infrastructure inside telco 5G networks for ultra-low mobile latency; Outposts run AWS hardware in your own data center for data residency and local processing. Each trades some service availability and management for proximity.

Use AWS Outposts (AWS hardware on-prem under your physical control), Local Zones within the jurisdiction if available, or a Dedicated Local Zone / AWS Sovereign Cloud where offered. Region selection itself is the first lever — choose a Region inside the legal boundary when one exists.

Peering connects exactly two VPCs; traffic cannot route through an intermediary peered VPC to reach a third. A full mesh of N VPCs requires N(N-1)/2 connections, which becomes unmanageable, so Transit Gateway (hub-and-spoke) is preferred beyond a handful of VPCs.

VPC peering and Transit Gateway both reject overlapping CIDRs for routing. Use PrivateLink to expose specific services (no CIDR overlap concern, only the endpoint matters), or re-IP one VPC, or place a private NAT gateway to translate addresses across a TGW attachment.

PrivateLink exposes a single service behind a Network Load Balancer (or GWLB) as an endpoint service; consumers create interface endpoints. It is unidirectional, scales to many consumers without CIDR coordination, and exposes only that service — not the whole network. Peering/TGW give full bidirectional network reachability.