Customers who upgrade to the fully-managed, privately-hosted product can have access to other assets and services and networks (like VPCs, security groups, RDS instances, Kinesis etc.) in their accounts with some caveats and exceptions. To be safe and sane, we keep our EKS managed cluster and software running in a separate VPC. We do support peering, using Transit Gateway, RDS proxy, and Private Link integrations but these integrations are not stock or off the shelf and require some setup, configuration, documentation, and so forth that could be very unique to each scenario.