I remember years ago that all citrix cloud connectors had to be able to get to all resources, even if they weren't used for it. For instance, if I have onprem cloud connectors, do they need to be able to do what is needed in a different resource location that is in AWS, or does it segment items now - if I create a host connection in a resource location for AWS, it will only try to use cloud connectors there?

Cloud connectors represent a presence in your resource location. Creating a resource location also creates a zone in DaaS. If you place your cloud connectors in your AWS zone, make sure they can communicate with your VDAs in AWS. They do not need to communicate with or reach resources in other zones.