Skip to content
PuglieseWeb Engineering HandbookSystemDox Pages

VIFs (virtual interfaces)

A Direct Connect connection carries no traffic on its own. Traffic flows over virtual interfaces: VLANs on the circuit, each with its own BGP session.

Private VIF ────→ VPC


Private VIF 1 ┐
              ├─→ Direct Connect gateway ────→ VPCs
Private VIF 2 ┘

Private VIF

Section titled “Private VIF”
  • Private connectivity to VPCs.
  • Reaches private resources — EC2 instances, RDS databases and anything else addressed from the VPC range.
  • Extends your private network into AWS.
  • The right choice for regular workload traffic between on-premises and AWS.
  • Supports IPv4 and IPv6 private addressing.
  • Requires BGP for route advertisement.

Public VIF

Section titled “Public VIF”
  • Direct access to AWS public service endpoints without internet transit.
  • Reaches services such as Amazon S3 and DynamoDB at their public endpoints, and AWS APIs generally.
  • Lets you advertise your own public prefixes to AWS.
  • Note that a public VIF gives access to AWS public endpoints across all Regions in the partition, not just one.

Transit VIF

Section titled “Transit VIF”
  • Connects to a transit gateway, through a Direct Connect gateway.
  • The right choice for hub-and-spoke designs and for reaching many VPCs, including across Regions.
  • Reaches VPCs attached to the transit gateway without a virtual interface per VPC.
  • Carries multicast where the transit gateway is configured for it.

Quotas and constraints

Section titled “Quotas and constraints”
  • A dedicated connection supports up to 50 private or public VIFs and up to 4 transit VIFs, to a combined maximum of 51. None of these can be increased.
  • A hosted connection supports exactly one virtual interface of any type.
  • A Direct Connect gateway holds up to 30 private or transit virtual interfaces.
  • A private virtual interface associates with either a single VPC through a virtual private gateway or a Direct Connect gateway — never both at once.
  • A virtual interface cannot be moved or reassigned. Changing its association means deleting it and creating a new one, which is a maintenance window.
  • Each virtual interface needs a distinct VLAN ID on the connection.
Section titled “Related pages”