AWS Direct Connect & VPN Security

Overview

AWS provides two primary services for connecting your on-premises network to AWS: AWS Direct Connect and AWS Site-to-Site VPN. Understanding when to use each, their security characteristics, and how they can be combined is essential for the SAA-C03 exam.

AWS Direct Connect establishes a dedicated, private network connection between your data center and AWS. It bypasses the public internet entirely, providing consistent performance and reduced bandwidth costs for high-volume workloads. However, it does not encrypt traffic by default.

AWS Site-to-Site VPN creates an encrypted IPsec tunnel over the public internet. It's faster to set up and lower cost but has variable performance due to internet routing.

For the exam, focus on the differences between these services, when to use each, and how to design highly available hybrid architectures. Understanding the security trade-offs between encryption and dedicated connectivity is critical.

Key Concepts

AWS Direct Connect

Connection Types

Dedicated Connections:

• Physical Ethernet port dedicated to your organization
• Requires colocation at AWS Direct Connect location (or partner cage)
• Provisioning time: 4-12 weeks
• Supports Link Aggregation Groups (LAGs)

Hosted Connections:

• Provisioned by AWS Direct Connect Partners
• Share partner's physical connection
• Faster provisioning (days to weeks)
• Lower capacity options available

Virtual Interfaces (VIFs)

Private VIF  → Connect to VPCs (via VGW or DX Gateway)
Public VIF   → Access AWS public services (S3, DynamoDB, etc.)
Transit VIF  → Connect to Transit Gateway (multiple VPCs)

Limits: Up to 50 public/private VIFs + 4 transit VIFs per dedicated connection (max 51 total).

Direct Connect Gateway

Direct Connect Gateway enables access to VPCs in any AWS Region from a single Direct Connect location:

On-Premises
    ↓
Direct Connect Location (us-east-1)
    ↓
Direct Connect Gateway
    ├── VPC in us-east-1
    ├── VPC in us-west-2
    ├── VPC in eu-west-1
    └── Transit Gateway (multi-region)

AWS Site-to-Site VPN

VPN Components

VPN Tunnel Options

Standard Tunnels (Default):

• Maximum 1.25 Gbps per tunnel
• Two tunnels per connection (active/passive or active/active)
• ECMP supported with Transit Gateway

Large Tunnels (NEW - November 2025):

• Maximum 5 Gbps per tunnel
• Combined 10 Gbps with both tunnels
• Only supported on Transit Gateway and Cloud WAN
• NOT supported on Virtual Private Gateway

Standard Tunnels:
  1 VPN Connection (2 tunnels) = 2.5 Gbps with ECMP
  4 VPN Connections (8 tunnels) = 10 Gbps with ECMP

Large Tunnels (5 Gbps):
  1 VPN Connection (2 tunnels) = 10 Gbps with ECMP
  4 VPN Connections (8 tunnels) = 40 Gbps with ECMP

Accelerated VPN

Accelerated VPN uses AWS Global Accelerator to route traffic via the AWS global network instead of the public internet:

• Lower latency: Traffic enters AWS network at nearest edge location
• Consistent performance: Avoids internet congestion
• Only supported on Transit Gateway (not VGW)
• Cannot be enabled on existing connections

Direct Connect vs VPN Comparison

When to Use Direct Connect

• Consistent, predictable performance required
• High bandwidth workloads (>1 Gbps sustained)
• Large data transfers (cost savings on egress)
• Regulatory compliance requiring private connectivity
• Mission-critical production workloads

When to Use Site-to-Site VPN

• Quick deployment needed (minutes vs weeks)
• Lower bandwidth requirements (<1 Gbps)
• Backup connectivity while waiting for Direct Connect
• Cost-sensitive environments
• Encryption required without additional setup

Security Considerations

Direct Connect Security

Traffic is NOT encrypted by default. Options for encryption:

1. MACsec (IEEE 802.1AE)

   • Layer 2 encryption at Direct Connect location
   • Supported on 10 Gbps and 100 Gbps dedicated connections
   • Encrypts traffic between your router and AWS router

2. Private IP VPN over Direct Connect

   • IPsec VPN tunnel over Transit VIF
   • End-to-end encryption
   • Uses private IP addresses (no public IPs needed)

3. Application-level encryption

   • TLS/SSL for application traffic
   • Works with any connection type

On-Premises Network
    ↓ (IPsec encrypted)
Direct Connect (Transit VIF)
    ↓
Transit Gateway (VPN Attachment)
    ↓
VPCs

Site-to-Site VPN Security

• Always encrypted with IPsec (IKEv1 or IKEv2)
• Uses industry-standard encryption algorithms
• Pre-shared keys or certificates for authentication
• Perfect Forward Secrecy (PFS) supported

Phase 1 (IKE):
  - AES-128-CBC, AES-256-CBC, AES-128-GCM, AES-256-GCM
  - SHA-1, SHA-256, SHA-384, SHA-512

Phase 2 (IPsec):
  - AES-128-CBC, AES-256-CBC, AES-128-GCM, AES-256-GCM
  - HMAC-SHA-1, HMAC-SHA-256

DPD (Dead Peer Detection): Enabled by default

Use Cases

Use Case 1: High-Performance Hybrid Connectivity

Scenario: Enterprise needs consistent, high-bandwidth connectivity for production workloads.

Solution:

• Two Direct Connect connections at different locations
• Connect to Transit Gateway via Transit VIFs
• Route propagation to all VPCs
• Optional: MACsec encryption for compliance

Use Case 2: Quick Hybrid Setup with Backup

Scenario: Start-up needs fast connectivity with future upgrade path.

Solution:

• Deploy Site-to-Site VPN immediately
• Order Direct Connect in parallel (4-12 week lead time)
• Migrate to Direct Connect as primary
• Keep VPN as encrypted backup

Use Case 3: Encrypted Private Connectivity

Scenario: Financial services company requires both dedicated connectivity AND encryption.

Solution:

• Direct Connect with Transit VIF
• Private IP VPN over Direct Connect
• Traffic encrypted with IPsec
• Consistent latency of Direct Connect

On-Premises
    ↓
[Direct Connect - Transit VIF]
    ↓
[Transit Gateway]
    ├── VPN Attachment (Private IP)
    └── VPC Attachments

Use Case 4: Multi-Region Connectivity

Scenario: Global company needs connectivity from single data center to VPCs in multiple regions.

Solution:

• Single Direct Connect location
• Direct Connect Gateway
• Private VIFs to VPCs in multiple regions
• OR Transit VIF to Transit Gateway (with peering)

High Availability Architectures

Direct Connect Resiliency Models

AWS provides a Resiliency Toolkit with recommended architectures:

On-Premises Data Center
    ├── Router 1 ──→ DX Location A ──→ Connection 1 ──→ AWS
    │                              └─→ Connection 2 ──→ AWS
    └── Router 2 ──→ DX Location B ──→ Connection 3 ──→ AWS
                                   └─→ Connection 4 ──→ AWS

VPN High Availability

Site-to-Site VPN includes two tunnels by default:

• Deploy across two Availability Zones
• Use BGP for automatic failover
• Consider multiple VPN connections for bandwidth

On-Premises (2 CGW devices)
    ├── CGW-1 ──→ Tunnel 1A ──┐
    │         ──→ Tunnel 1B ──┤
    └── CGW-2 ──→ Tunnel 2A ──┼──→ Transit Gateway ──→ VPCs
              ──→ Tunnel 2B ──┘

Total: 4 tunnels with ECMP = ~5 Gbps (standard) or ~20 Gbps (large)

Best Practices

Direct Connect Best Practices

1. Plan for resiliency

   • Use multiple Direct Connect locations
   • Implement LAGs for port aggregation
   • Consider VPN backup

2. Use Transit VIF for scale

   • Single Transit VIF connects to Transit Gateway
   • Supports thousands of VPCs
   • Simplifies routing

3. Enable MACsec when available

   • Layer 2 encryption for compliance
   • Available on 10/100 Gbps connections

4. Monitor with CloudWatch

   • Connection state metrics
   • BGP session status
   • Virtual interface statistics

VPN Best Practices

1. Use Transit Gateway for scale

   • Connect multiple VPCs with single VPN
   • Supports Accelerated VPN
   • Enables ECMP for bandwidth

2. Enable Accelerated VPN

   • Lower latency via AWS network
   • More consistent performance
   • Requires Transit Gateway

3. Use BGP for dynamic routing

   • Automatic failover between tunnels
   • Route propagation
   • Supports ECMP

4. Implement both tunnels

   • Active/active for bandwidth
   • Active/standby for simplicity
   • Both provide redundancy

Common Exam Scenarios

Common Pitfalls

Pitfall 1: Assuming Direct Connect is Encrypted

Mistake: Believing Direct Connect traffic is automatically secure.

• Why it fails: Direct Connect does NOT encrypt traffic by default
• Correct approach: Enable MACsec, or use Private IP VPN over Direct Connect

Pitfall 2: Single Direct Connect Location

Mistake: Deploying Direct Connect at only one location.

• Why it fails: Single point of failure, no SLA
• Correct approach: Use at least two locations for production workloads

Pitfall 3: VPN on Virtual Private Gateway for Scale

Mistake: Attaching VPN to VGW when connecting many VPCs.

• Why it fails: VGW connects to single VPC only
• Correct approach: Use Transit Gateway for multi-VPC VPN

Pitfall 4: Not Using ECMP

Mistake: Single VPN connection for high-bandwidth needs.

• Why it fails: Limited to ~1.25-5 Gbps per tunnel
• Correct approach: Multiple VPN connections with ECMP on Transit Gateway

Pitfall 5: Forgetting VPN Has Two Tunnels

Mistake: Only configuring one tunnel on customer gateway.

• Why it fails: Loses redundancy, potential single point of failure
• Correct approach: Configure both tunnels for high availability

Pricing Summary

Direct Connect Pricing

Site-to-Site VPN Pricing

Related Services

Quick Reference

Direct Connect Bandwidth Options

VPN Tunnel Bandwidth

Quiz Questions

Further Reading

• AWS Direct Connect Documentation
• AWS Site-to-Site VPN Documentation
• Direct Connect Pricing
• Accelerated VPN Connections
• Direct Connect Resiliency Toolkit
• VPC Connectivity Options Whitepaper