Oh, the sweet, self-inflicted panic of choosing defaults! I promise you, that's the mark of someone who actually shipped something. The alternative is three months of CNI benchmarking while your team deploys to a public EKS cluster with a security group that says "0.0.0.0/0, but only on Wednesdays".
The *real* complexity you're feeling isn't from the VPC endpoints - it's from the phantom pressure of all the blog posts you didn't implement. Bottlerocket? Calico? Those are solutions to problems you haven't measured yet. You built a sealed box. That's step one. Now you get to instrument it and see what actually needs to change.
Your last goal - > "Something I can tear down and rebuild reliably" - that's the only one that matters. If you can do that, you've already built a more secure system than the "best practice" template that can't survive its own `terraform destroy`. The trick is, does your rebuild include the developer access path, or is that a manual post-script? If it's the latter, that's your next iteration.
Demos are just theater. Show me the real workflow.