Hybrid and cross-account networking
AWS Direct Connect
Section titled “AWS Direct Connect”Direct Connect provides a private, dedicated connection from an on-premises network into AWS that does not cross the public internet.
What it gives you
Section titled “What it gives you”- A physical circuit established through an AWS Direct Connect Partner or your existing network provider, terminating at a Direct Connect location.
- BGP routing between your network and AWS.
- Connectivity to VPCs through a virtual private gateway or a Direct Connect gateway, and to AWS public endpoints through a public virtual interface.
- Lower and more predictable data transfer charges than internet egress.
Where it fits
Section titled “Where it fits”- Consistent network performance is a requirement rather than a preference.
- Large data transfers where internet egress charges would dominate.
- Compliance rules that require private connectivity.
- Latency-sensitive workloads spanning on-premises and AWS.
What it costs you
Section titled “What it costs you”- More expensive than VPN for the same nominal bandwidth.
- Provisioning takes weeks, not hours — a physical cross-connect has to be installed.
- A relationship with a third-party provider, and a dependency on their infrastructure.
Direct Connect gateway
Section titled “Direct Connect gateway”A Direct Connect gateway lets one set of Direct Connect connections reach VPCs in more than one Region, and removes the need for a virtual interface per VPC.
- Associates with up to 20 virtual private gateways or up to 6 transit gateways. Neither quota can be increased.
- Holds up to 30 private or transit virtual interfaces.
- Centralises Direct Connect management: virtual interfaces attach to the gateway, and the gateway attaches to the VPCs.
- A Direct Connect gateway does not route between the VPCs associated with it. Two VPCs behind the same gateway can each reach on-premises, but not each other — that requires peering or a transit gateway.
Site-to-Site VPN
Section titled “Site-to-Site VPN”- Fast to deploy — minutes rather than weeks.
- IPsec encryption over the public internet.
- Two tunnels per connection, to two separate AWS endpoints, for redundancy.
- Native CloudWatch metrics and logging.
Components
Section titled “Components”- Customer gateway (CGW) — the resource in AWS that describes your on-premises endpoint: its public address and BGP ASN.
- Virtual private gateway (VGW) — the AWS-side endpoint, attached to one VPC.
- VPN connection — the pair of IPsec tunnels between them.
- Transit gateway — an alternative AWS-side endpoint when the VPN should reach several VPCs.
Transit VPC
Section titled “Transit VPC”A transit VPC is a central hub built from third-party virtual appliances — a Cisco CSR, a Juniper vSRX, or similar — that routes between VPCs across Regions, on-premises sites and other clouds.
- All traffic flows through the central VPC rather than requiring a connection between every pair of locations.
- Appliances can apply routing policies and traffic inspection that AWS-managed services do not offer.
- Works across Regions and to other cloud providers.
AWS now recommends Transit Gateway for most of these cases: the same topology, fully managed, with less to operate. A transit VPC remains reasonable where a specific vendor capability is required or an existing deployment already works.
Redundancy
Section titled “Redundancy”Direct Connect with VPN backup
Section titled “Direct Connect with VPN backup”Primary traffic takes the Direct Connect circuit; a Site-to-Site VPN carries it if the circuit fails.
Both paths advertise the same on-premises prefixes over BGP, and Direct Connect is preferred. When it fails, BGP withdraws its routes and traffic moves to the VPN with no manual intervention.
This is the cheapest useful redundancy, and the usual starting point. Note the asymmetry: the VPN’s throughput is a fraction of the circuit’s, so a failover is a capacity event as well as a routing event.
Dual Direct Connect
Section titled “Dual Direct Connect”Two circuits, ideally through different providers and terminating at different Direct Connect locations.
- Entirely private on both paths, with no internet dependency.
- BGP handles failover.
- Considerably more expensive.
- SiteLink allows two Direct Connect locations to exchange traffic through the AWS global network directly, so a Direct Connect gateway can also serve as the path between two of your own data centres.
Redundancy through a single Direct Connect location protects against a circuit failure but not against a failure of the location itself. AWS’s higher availability guidance calls for connections at separate locations.
Multi-Region
Section titled “Multi-Region”- Transit gateway peering attachments between Regions.
- A Direct Connect gateway associated with transit gateways or virtual private gateways in each Region.
- Redundant Direct Connect circuits into each Region for the highest tier, or a single set of circuits into a Direct Connect gateway that fans out to several Regions for a cheaper design that shares fate on the circuit.
- Availability Zone redundancy within each Region, which is a separate concern from the hybrid link.
Design trade-offs
Section titled “Design trade-offs”Cost against performance. Direct Connect costs more, performs more predictably and takes longer to provision. VPN costs less, performs as well as your internet connection does that day, and can be live this afternoon. Running both is the common answer.
Where the single points of failure are. One circuit, one router, one Direct Connect location, one customer gateway: each is a place the hybrid link can fail entirely. Redundancy is only real when it is at a different layer from the thing it protects.
How many VPCs. One or two VPCs can attach a virtual private gateway each. Beyond that, a transit gateway with a transit virtual interface replaces a growing set of per-VPC virtual interfaces.