The great thing about AWS Re:Invent is that all the sessions get posted to YouTube 48 hours after they happen. These two sessions are especially relevant to NET+ AWS subscriber. Thanks to Mark Larsen for flagging these.

Architecting security & governance across your landing zone (SEC325-R2) (aka AWS Orgs OU configuration recommendations)

AWS Transit Gateway reference architectures for many VPCs (NET406-R1)

Feel free to post additional session videos in the comments below.