In reply to Keith Yam.

Hi Keith,

1)Yes. You can use VGW to connect TransitVPC with your on-prem network through Direct Connect. And this could be the least configuration involved way to do it. Meanwhile, we are working with AWS on alternatives ways to leverage Cisco DMVPN and other technologies. Please stay tuned.

2)If you take a look at the cloud formation template or Lambda, automation will take care of the site-to-site IPSEC config and BGP configurations. As long as your CLI doesn't touch these things, it should be good. Direct CLI could be needed if you want to manipulate the routes in CSR. For example, different spoke VPC will be in different VRF and by default they can talk to each other because different VRF has import/export the same RT(Route-Target), if you want to segment the connectivity, you probably need to change it by CLI. Besides, CLI also useful in trouble shooting.