One network, many accounts — without VPC peering hairballs.

The peering mesh had grown organically. Every time a new account joined the org, the runbook said "peer with these N other accounts." After a year, the mesh edges outnumbered the team members. Nobody knew which paths were transitive-via-which-route-table.

We migrated to a single shared VPC per environment, with subnets shared into the consumer accounts via RAM. The Transit Gateway carried inter-environment traffic; Network Firewall inspected the north-south paths. Route 53 private hosted zones followed the same sharing model.

The peering count went from 24 to zero. New workload network setup dropped to under a day because the workload account inherits everything from the shared VPC. Cross-VPC incident rate fell 84% year-over-year — most of the previous incidents had been peering-related route surprises.