We may have internal resources we want to access securely (databases, kibana, etc.) so a VPN would be nice to be able to get access to the VPC.
Wireguard on an EC2 instance is probably a fine place to start, maybe we can use this terraform or something similar:
https://github.com/jmhale/terraform-aws-wireguard

It would also be nice to have an internal route53 zone so we can create internal-only hostnames for things.