It works on my VPC.

Welcome, network adventurer. If you can read this page, your packets survived route tables, security groups, and at least one questionable NACL decision.

• DNS: It is not magic. It just fails in very creative ways.
• Security Groups: Stateful bouncers with a clipboard.
• NACLs: Stateless chaos, now with rule numbers.
• Transit Gateway: Because one VPC was never enough.

Workshop motto: keep calm, check the route table, and never trust "it should be open."