AWS VPN and Direct Connect

Many companies keep some systems in their own offices and others in AWS. AWS Site-to-Site VPN and AWS Direct Connect link those two worlds. VPN builds a secure tunnel across the public internet. Direct Connect builds a private physical line straight into AWS.

Picture two buildings in different cities. A VPN is like sending an armored truck along public highways. Direct Connect is like building a private road between the buildings.

Why Hybrid Connections Matter

  • Offices access cloud applications as if they sat on the local network.
  • Databases stay on premises while web servers run in AWS.
  • Large data transfers move without crowding the public internet.
  • Companies migrate to the cloud in stages.

AWS Site-to-Site VPN

A Site-to-Site VPN connects your office network to your VPC through encrypted tunnels. Each connection includes two tunnels for backup. Setup takes minutes, and no special cabling is needed.

Main Components

  • Customer gateway: a record of your office router or firewall.
  • Virtual private gateway or transit gateway: the AWS endpoint of the tunnel.
  • VPN connection: the pair of encrypted tunnels between the two sides.
  • Route table entries: instructions that send traffic for each network through the tunnel.
 Office Network                          AWS Cloud
+----------------+                  +-----------------+
| Laptops,       |                  |  VPC            |
| servers        |                  |  10.0.0.0/16    |
| 192.168.0.0/16 |                  |                 |
+-------+--------+                  +--------+--------+
        |                                    |
 Customer Gateway  ==== Tunnel 1 ====  Virtual Private
 (Office router)   ==== Tunnel 2 ====  Gateway
              (encrypted, over the internet)

Strengths and Limits

  • Setup is quick and inexpensive.
  • Speed depends on internet quality and varies from moment to moment.
  • Each tunnel has a bandwidth cap, so very large transfers need another approach.

AWS Direct Connect

Direct Connect gives you a dedicated network link from your location to AWS. A telecom provider runs a cable from your site to a Direct Connect location, where it meets the AWS network. Traffic skips the public internet.

Benefits

  • Consistent latency because the path stays fixed.
  • Higher bandwidth, with dedicated connections offered at speeds such as 1, 10, or 100 Gbps.
  • Lower data transfer costs for large volumes in many cases.

Things to Know

  • Lead time is longer than VPN because physical cabling is involved.
  • Traffic is private but not encrypted by default. Add a VPN over Direct Connect or use MACsec where supported when encryption is required.
  • A single link is a single point of failure. Order two links in different locations for important systems.
 Your Data Center
        |
 Telecom Provider Cable
        |
 Direct Connect Location
        |
 AWS Network
        |
 Your VPC  and  AWS public services

Choosing Between VPN and Direct Connect

+---------------------+------------------+-------------------+
| Need                | Site-to-Site VPN | Direct Connect    |
+---------------------+------------------+-------------------+
| Fast setup          | Yes              | No                |
| Consistent speed    | No               | Yes               |
| Built-in encryption | Yes              | No (add-on)       |
| Cost for small use  | Lower            | Higher            |
| Large data volume   | Limited          | Strong fit        |
+---------------------+------------------+-------------------+

Many organizations start with VPN and add Direct Connect as traffic grows. Some keep VPN permanently as a backup path.

AWS Client VPN

Client VPN serves individual users instead of whole offices. An employee installs a VPN client on a laptop and connects to a VPC securely from home. Authentication can use Active Directory, certificates, or single sign-on.

Transit Gateway

A company with many VPCs and offices can create a tangled web of connections. A transit gateway acts as a central hub. Every VPC, VPN, and Direct Connect link plugs into the hub once.

 Office A --+              +-- VPC 1
 Office B --+-- Transit  --+-- VPC 2
 Data Ctr --+   Gateway   +-- VPC 3

Practice Outline

  1. Create a VPC with a private subnet.
  2. Create a virtual private gateway and attach it to the VPC.
  3. Create a customer gateway with your router's public IP address.
  4. Create the VPN connection and download the configuration file.
  5. Delete the connection after the lab to avoid hourly charges.

Best Practices

  • Use non-overlapping IP address ranges on both sides.
  • Monitor tunnel status with CloudWatch alarms.
  • Plan redundant paths for production workloads.
Previous lesson
Back to course
Next lesson