A checklist beats a vibe check.
The minimum signals that separate production-ready from "worked in a demo."
✓One NAT Gateway per AZ, never one shared across AZs
✓Direct Connect resiliency model chosen deliberately, location-diverse
✓All five defense-in-depth layers present, not just Security Groups
✓The right connectivity tool per relationship — backbone, mesh, external exposure
✓A tested multi-region failover path, not just a documented one
This deck was built to be studied from directly. If a question came up these slides and notes didn't fully answer, check AWS's own current documentation for that one service — not a sign the decision frameworks here are wrong.