Redesign a sprawling multi-account AWS network with a data center link

A retailer has 18 VPCs in us-east-1 and 6 in eu-west-1 across 9 AWS accounts. They grew one peering at a time and now have over 40 peering connections and route entries nobody fully understands. The data center (AS 65010, 192.168.0.0/16) connects over two site-to-site VPNs. New requirements:

• On-prem must reach every VPC; all VPCs must reach shared services (directory, DNS, CI).
• Prod and dev must be isolated from each other.
• Traffic between on-prem and AWS, and all internet egress, must pass a stateful firewall.
• About 3 Gbps steady traffic to on-prem with predictable latency, surviving the loss of one facility.
• Two dev VPCs both use 10.0.0.0/16.