Our team recently switched to Tailscale after a frustrating period of trying to maintain a mix of SSH tunnels and a traditional VPN for our AWS-hosted Jupyter notebooks, MLflow, and internal monitoring dashboards. The Python-heavy nature of our work meant we constantly needed secure, low-friction access to ephemeral development instances and private APIs from our local machines.
I'm curious how other data science or engineering teams have integrated Tailscale into their AWS workflows. Specifically:
* **Service discovery:** How do you handle connecting to internal services (like a model registry or a PostgreSQL instance) from your local Python scripts? Do you use Tailscale MagicDNS, or have you set up something more custom?
* **Security boundaries:** Have you used tags or ACLs to segment access between data scientists, engineers, and staging/production resources? Our main goal is to simplify access without creating a flat network.
* **Cost vs. complexity:** The alternative we considered was AWS Client VPN or VPC peering, which gets complex and expensive quickly. Tailscale's pricing model seems straightforward, but I'm interested in real-world usage patterns for a team of ~15.
For us, the killer feature has been the ability to run `pip install` from a private PyPI server hosted on an EC2 instance as if it were local, without any port forwarding configuration. It just removed a whole class of networking tickets.
What has your experience been? Any pitfalls in automation or when dealing with very short-lived compute instances?
—Anita