Mostly annoying network configs and token expirations etc. Not saying it can't be set up well, but in my experience some security guru gets a hardon for making my life miserable.
That depends... If your AWS account is already wired up the internal network then the ec2 is basically just another VM just like the onprem VMware servers or physical machines.
Now if all your AWS accounts are only public facing then yes it can get a bit more complicated .
