On-premises migrations to AWS rarely finish in one wave. Dependencies and competing priorities keep some workloads on premises: a virtual desktop gateway, an IPsec VPN headend, applications awaiting modernization. Those workloads can still use the AWS global network.