@jordan unsolicited advice from someone who's run a PaaS before- avoid this if you can it's an operational nightmare, I'd come up with some sort of wireguard router ami as the golden path for vpc to vpc connectivity. added benefit of working across any cloud provider.
if you don't want to roll your own tailscale have a good way to do this
https://github.com/hardfinhq/terraform-aws-tailscale-subnet-router