One VPC reaching another over AWS's backbone, no public IPs. A working two-account demo, and the parts that bit me.