The simplest way to install Tailscale is to run a copy on every client and server machine or VM in your organization. That way, traffic is end-to-end encrypted, and you can migrate machines between physical locations without changing their IP addresses or causing disruption.
However, in many cases, you’ll have a subnet full of machines that you don’t yet want to, or cannot, install Tailscale on directly. In those cases, you can set up a Tailscale “relay node” to advertise the entire subnet at once. The relay node routes all traffic from the Tailscale network onto your physical subnet. This allows for easier incremental deployment, or deployment onto legacy networks.
In particular, you can deploy to an AWS VPC to share the entire VPC with your team. You can then restrict access to particular users or devices by using Tailscale Access Control Lists (ACLs).
Read more.