Shared services for isolated tenants: PrivateTGW subnets
Three pods with identical private addressing all need the same WSUS, repo and AD. One shared-services VPC with a PrivateTGW subnet serves all of them over the transit gateway — and can’t reach back into any of them. The directional test, and why SNAT is what makes it work.