the AWS VPN Gateway approach isn't perfect either. it doesn't automatically propagate routes to the VPN peers' LANs to its subnets' routing tables