Direct Connect
AWS Direct Connect is a dedicated network connection between your own infrastructure and AWS. Traffic travels over a private circuit rather than the public internet, which makes throughput and latency predictable and reduces data transfer charges.
Connection types
Section titled “Connection types”Dedicated connection. A physical Ethernet port allocated to you at a Direct Connect location, ordered through the AWS console, CLI or API. Available at 1, 10, 100 and 400 Gbps over single-mode fibre.
Hosted connection. A slice of a partner’s port, provisioned on your behalf by an AWS Direct Connect Partner. Partners offer sub-port capacities, which makes a hosted connection the practical option below 1 Gbps or where you have no presence in a Direct Connect facility.
Link Aggregation Groups (LAG). Several dedicated connections bundled into one logical connection. A LAG can hold up to four connections below 100 Gbps, or two at 100 Gbps.
Virtual interfaces
Section titled “Virtual interfaces”A connection carries no traffic until you create virtual interfaces (VIFs) on it. Each VIF is a VLAN with its own BGP session. See VIFs.
- Private VIF — reaches VPCs, through a virtual private gateway or a Direct Connect gateway.
- Public VIF — reaches AWS public service endpoints, such as Amazon S3, without internet transit.
- Transit VIF — reaches a transit gateway, through a Direct Connect gateway.
A dedicated connection supports up to 50 private or public VIFs and up to 4 transit VIFs, to a combined maximum of 51. A hosted connection supports exactly one.
What you get
Section titled “What you get”Performance. Consistent, predictable throughput and latency, and higher capacity than most internet connections.
Privacy. The circuit does not traverse the public internet. Note that Direct Connect is not encrypted by default — if encryption in transit is a requirement, run an IPsec VPN over the circuit, or use MACsec where the port speed and location support it.
Cost. Data transfer out of AWS over Direct Connect is charged at a lower rate than internet egress, and the charge is predictable. Against that, set the port-hour charge and the circuit cost from your provider.
Availability
Section titled “Availability”Availability depends entirely on how the connections are arranged.
Single connection. One circuit, one router, one Direct Connect location. Any of the three failing takes the link down, as does maintenance at the location.
Active/active. Two or more connections at different Direct Connect locations, terminating on different customer routers, with BGP distributing traffic across them and failing over automatically. This is the arrangement AWS recommends for business-critical workloads.
Active/standby. The same physical redundancy, but with BGP attributes — AS path prepending or local preference — making one path preferred. Failover is automatic but takes as long as BGP convergence.
Two circuits into the same Direct Connect location protect against a circuit failure but not against the loss of that location. Diversity means different locations, different providers and different customer routers.
For a cheaper backup, keep a Site-to-Site VPN advertising the same prefixes. It carries less traffic, but it is a path.
Direct Connect or VPN
Section titled “Direct Connect or VPN”| Site-to-Site VPN | Direct Connect | |
|---|---|---|
| Time to provision | Minutes | Weeks |
| Path | Public internet, encrypted | Private circuit |
| Performance | Follows your internet connection | Consistent and predictable |
| Encryption | IPsec, always | Not by default; add a VPN or MACsec |
| Capacity | Per-tunnel limits; aggregate with ECMP | 1, 10, 100 or 400 Gbps per dedicated connection |
| Cost | Low | Port-hours plus a circuit from a provider |
A VPN is secure but its performance is whatever the internet gives you that day. Direct Connect is fast, consistent and able to carry large volumes, at the cost of money and lead time. Running both — Direct Connect as primary, VPN as backup — is the standard hybrid design.
Where it is used
Section titled “Where it is used”- Hybrid architectures where on-premises systems and AWS workloads are in constant conversation
- Large-scale data migration
- Real-time data processing that cannot tolerate variable latency
- Disaster recovery replication
- Any workload where the network being slow today is a business problem