Thanks for the feedback -- agreed on the reserved capacity being an anti-pattern.

For the third point, what I've suggested in the past to push your artifacts into the region (since that's free) and then pull it down from S3. This lets you only incur S3 costs which tend to be cheaper then NAT data transfer costs (assuming you're using a VPC endpoint or equivalent).