However, the overhead costs of the VPC (e.g. NAT Gateway costs, VPC Flow Log costs) are not charged to or shared by Cornell AWS accounts.

Guidelines

Customers using the Shared VPC must agree to abide by the following guidelines:

Customers cannot use the Shared VPC to deploy systems that utilize large quantities of IPv4 addresses. For example:
- Kubernetes clusters and the Amazon Elastic Kubernetes Service (EKS) both use large numbers of IP addresses, even for trivial deployments.
- Large AWS EMR deployments. (EMR clusters with a handful of nodes are OK.)
TBD

Best Practices

Use Security Groups applied to resources deployed in the Shared VPC to restrict ingress to those resources, even by traffic from the local VPC and subnets. You don't want to be affected by something dumb another team does when they are using the Shared VPC.
When deploying replicas of a specific resource, be sure to spread them out across multiple subnets and multiple AZs.
Be especially careful about configuring resources that automatically scale up (e.g., EC2 Auto Scaling Groups).
If you are managing Elastic Network Interfaces directly, be sure to delete them once they are no longer needed.