It was news to me that Tailscale allowed DNS lookups for particular domains to hit specific resolvers and those resolvers would serve up the internal VPC address, so you need nothing except a subnet router inside the VPC to be working against your secured AWS resources.

It means that you can close all the open ports on your VPC security groups without changing the configuration of how your external systems access the internal AWS services.

It was probably obvious to everybody else, but after I worked that out, Tailscale became my network.