When we built our hybrid stack last year, the routing oddities drove us crazy too, so I get what you mean. One thing that helped was documenting every single route, even the ones that “should” work out of the box, because in hybrid environments assumptions fall apart quickly. For example, we had an intermittent issue where packets took a weird detour because of overlapping CIDRs that nobody noticed at first — looked fine on paper, then suddenly half the traffic flowed through a backup interface.
Another tip from our experience: test failover paths at different loads rather than only during controlled maintenance windows. Under heavy load the VPN tunnels behaved differently — we saw packet drops that never appeared during light traffic. Eventually we switched parts of the setup to Direct Connect, which stabilized everything, but not everyone can do that immediately.If you want something more structured, this page helped us map out what we were missing: aws consulting — it gave us a clearer idea of what “good” hybrid routing should look like. Maybe some points there will help you catch blind spots in your design.