Security between private VPC to on premise networks

So this might be some what outside the scope of the sub but for those deploying hybrid clouds what security boundaries do you maintain between them and on-premise networks?

For example if you are deploying non-web facing servers that may need to access on-premises resources such as AD or do you just rely on (AWS) cloudtrail, cloudwatch and vpc-side firewalls? Do you also limit them at on-premises firewalls? Do you maintain separate them into separate forests? Do the same teams that manage the cloud elements maintain also maintain on premise elements? If someone has a better sub for this to go throw some names out thanks!