diff --git a/tech_docs/cloud/aws_notes.md b/tech_docs/cloud/aws_notes.md
index b93db26..eea2850 100644
--- a/tech_docs/cloud/aws_notes.md
+++ b/tech_docs/cloud/aws_notes.md
@@ -1,3 +1,119 @@
+To complete your **networking trifecta**, you need a specialization that bridges the gap between traditional infrastructure and cloud-native environments while addressing modern architectural challenges. The **third pillar** should be:  
+
+### **Hybrid & Multi-Cloud Networking**  
+*(The glue between on-prem, AWS, and other clouds like Azure/GCP)*  
+
+#### **Why This Completes Your Trifecta?**  
+1. **Traditional Networking** (Campus/DC):  
+   - You understand physical hardware, BGP, OSPF, VLANs, and data center architectures.  
+2. **AWS Networking**:  
+   - You’ve mastered VPC, Direct Connect, Transit Gateway, and cloud-native security.  
+3. **Hybrid & Multi-Cloud Networking**:  
+   - You now solve **interoperability** challenges—connecting legacy systems to AWS while integrating with Azure/GCP, Kubernetes, and edge locations.  
+
+---
+
+### **Key Skills to Master for Hybrid/Multi-Cloud**  
+#### **1. Modern Connectivity Patterns**  
+- **SD-WAN Integration**:  
+  - Replace MPLS with **AWS Cloud WAN** or third-party SD-WAN (Cisco Viptela, VMware Velocloud).  
+  - Use **Direct Connect + VPN** for redundant hybrid links.  
+- **Multi-Cloud Peering**:  
+  - **AWS Transit Gateway** ↔ **Azure Virtual WAN** ↔ **Google Cloud Interconnect**.  
+
+#### **2. Zero Trust Networking (ZTN)**  
+- **Beyond VPNs**:  
+  - Implement **AWS Verified Access** or **Cloudflare Tunnels** for app-level security.  
+  - Enforce **identity-aware routing** (e.g., Tailscale, Zscaler).  
+- **Microsegmentation**:  
+  - Extend **Security Groups** to on-prem with tools like **Cisco ACI** or **VMware NSX**.  
+
+#### **3. Kubernetes Networking**  
+- **Multi-Cluster Networking**:  
+  - **AWS EKS** ↔ **Azure AKS** via **Submariner** or **Cilium Cluster Mesh**.  
+  - **Service Mesh** (Istio, Linkerd) for cross-cloud L7 traffic management.  
+- **Ingress/Egress Control**:  
+  - **AWS Load Balancer Controller** + **Nginx Ingress** for hybrid apps.  
+
+#### **4. Observability & Troubleshooting**  
+- **Unified Monitoring**:  
+  - Correlate **VPC Flow Logs** with **on-prem NetFlow** (via tools like Kentik or ThousandEyes).  
+  - Use **OpenTelemetry** for tracing across clouds.  
+- **Packet-Level Debugging**:  
+  - **Traffic Mirroring** (AWS) → **Gigamon** (on-prem) → **Wireshark**.  
+
+#### **5. Cost & Governance**  
+- **Cross-Cloud Cost Attribution**:  
+  - **AWS CUR** + **Azure Cost Management** + **GCP Billing Export**.  
+  - Tag resources consistently (e.g., `CostCenter=FinTech-Prod`).  
+- **Policy as Code**:  
+  - Enforce **SCPs (AWS)** + **Azure Policy** + **GCP Org Policies**.  
+
+---
+
+### **Real-World Use Cases to Practice**  
+#### **Lab 1: Build a Multi-Cloud Hub-and-Spoke**  
+1. **Connect AWS TGW to Azure Virtual WAN**:  
+   ```bash
+   # AWS side (TGW attachment)
+   aws ec2 create-transit-gateway-vpc-attachment --transit-gateway-id tgw-123 --vpc-id vpc-abc
+   ```
+   ```powershell
+   # Azure side (Virtual Hub connection)
+   New-AzVirtualHubVnetConnection -ResourceGroupName "rg1" -VirtualHubName "hub1" -Name "aws-connection" -RemoteVirtualNetwork $awsVnet
+   ```
+2. **Route Propagation**:  
+   - Share routes via **BGP** (Direct Connect) or **static routes**.  
+
+#### **Lab 2: Implement Zero Trust for Legacy Apps**  
+1. **Deploy AWS Verified Access**:  
+   ```bash
+   aws ec2 create-verified-access-instance --description "Legacy-App-Access"
+   ```
+2. **Replace VPN with Tailscale**:  
+   ```bash
+   # On-prem server
+   tailscale up --advertise-routes=10.0.1.0/24 --accept-routes
+   ```
+
+#### **Lab 3: Debug Multi-Cluster Kubernetes Networking**  
+1. **EKS ↔ AKS Connectivity**:  
+   ```bash
+   # Install Submariner
+   subctl join broker-info.subm --clusterid=aws-cluster
+   ```
+2. **Verify Cross-Cluster Services**:  
+   ```bash
+   kubectl get svc --context=aks-cluster -n app | grep "ClusterIP"
+   ```
+
+---
+
+### **Tools to Add to Your Arsenal**  
+| Category              | Tools to Master                                                                 |
+|-----------------------|---------------------------------------------------------------------------------|
+| **Hybrid Connectivity** | AWS Site-to-Site VPN, Azure ExpressRoute, Megaport, Aviatrix                    |
+| **Multi-Cloud Networking** | AWS TGW, Azure Virtual WAN, Google Network Connectivity Center                 |
+| **Observability**     | Kentik, ThousandEyes, OpenTelemetry, Prometheus + Grafana                       |
+| **Security**          | AWS Verified Access, Zscaler, Cloudflare Tunnels, HashiCorp Boundary            |
+| **K8s Networking**    | Cilium, Calico, Istio, Submariner                                               |
+
+---
+
+### **Why This Makes You Unstoppable**  
+- **Traditional Networking**: You speak the language of routers and switches.  
+- **AWS Networking**: You’re the cloud VPC guru.  
+- **Hybrid/Multi-Cloud**: You’re now the **translator** who connects legacy systems to the future.  
+
+**Career Impact**: This trifecta positions you for roles like:  
+- **Cloud Network Architect**  
+- **Hybrid Infrastructure Lead**  
+- **Multi-Cloud Solutions Engineer**  
+
+Want a **hands-on lab** for any of these scenarios? I can provide step-by-step break/fix exercises!
+
+---
+
 Here’s a **mini-lab** to practice the killer skills from our discussion, using only AWS Free Tier resources where possible. You’ll diagnose a real-world scenario, optimize costs, and enforce tagging—just like a cloud network SME would.
 
 ---