Designing secure connectivity between AWS and your own physical data centre is the foundation of hybrid networking. It replaces risky, unsecured public internet links with private, encrypted pathways that meet enterprise security requirements. For the SAP-C02 exam, mastering this concept is critical because it tests your ability to architect resilient, compliant connections that protect sensitive data in transit.
Jump to a section
A simple way to picture Designing Secure VPC Connectivity and Hybrid Networking
A secure courier service uses a system of fortified exchange points and trusted routes to move packages between a company’s private headquarters and a supplier’s distant warehouse. The headquarters is a private office building with restricted access, representing the on-premises data centre. The warehouse is a separate facility owned by the same company but located across town, representing the AWS Virtual Private Cloud (VPC).
The courier does not use public roads where anyone could intercept the package. Instead, the company installs a direct, private cable between the two buildings, known as a leased line or dedicated connection. This cable runs through a secure, underground conduit that only the company controls, exactly like an AWS Direct Connect link. At each end of this cable sits a guarded gatehouse. The gatehouse at the headquarters is the customer gateway, a physical device that controls traffic leaving the building. The gatehouse at the warehouse is the virtual private gateway, a software-defined entry point within the VPC that authenticates every incoming package.
For backup or smaller shipments, the courier uses an encrypted armoured van that travels on public roads. The van itself is the Site-to-Site VPN tunnel. The encryption of the packages inside the van is the IPsec protocol, which scrambles the data so that even if the van is stopped, the contents remain unreadable. The van’s route book, which specifies which roads are allowed, is the route table inside the VPC that directs traffic to the correct gatehouse. The overall contract that defines the courier’s operating hours, security standards, and routes is the transit gateway, a central hub that connects all the buildings and manages the flow of goods without letting them cross into public hands.
Secure VPC connectivity and hybrid networking let you join your own physical data centre (on-premises environment) with your virtual network in AWS (the VPC) as if they were one single, private network. Before hybrid networking, companies either kept everything in their own building (which limited scalability) or moved everything to the public cloud (which created security and latency fears). Hybrid networking gives you the best of both: you keep sensitive data on-site but use the cloud for burst computing, disaster recovery, or global reach.
The key building blocks are as follows. A Virtual Private Cloud (VPC) is your own isolated section of the AWS cloud where you launch resources like servers (Amazon EC2 instances). Think of it as a private room inside a massive shared office building. A customer gateway is a physical or software appliance you install at your on-premises location that acts as the door through which all traffic from your data centre enters the connection. A virtual private gateway is the AWS-side counterpart attached to your VPC that receives and authenticates traffic from the customer gateway.
There are two main methods to connect these two worlds. The first is an AWS Site-to-Site VPN. This creates an encrypted tunnel across the public internet between your customer gateway and the virtual private gateway. The encryption is done using the IPsec protocol suite, which scrambles every packet so that even if someone intercepts the data on the internet, they see only gibberish. The VPN is fast to set up (often within minutes) and relatively cheap, but it relies on the public internet, so it can suffer from variable latency and throughput.
The second method is AWS Direct Connect. This is a physical, dedicated fibre-optic cable from your on-premises data centre directly into an AWS Direct Connect location. You lease this line from a network provider. Direct Connect gives you consistent, low latency, high bandwidth, and a more secure connection because your data never touches the public internet. However, it takes weeks or months to provision and costs significantly more. Many enterprises use both: Direct Connect for primary traffic and VPN as a backup (failover) link.
To manage complex networks that involve multiple VPCs and multiple on-premises locations, AWS provides the transit gateway. A transit gateway acts as a single central hub that can connect hundreds of VPCs and on-premises networks together. Instead of creating individual peering connections (like separate direct cables) between every pair of VPCs, you connect each VPC and each on-premises gateway to the transit gateway. This simplifies network architecture, reduces management overhead, and allows you to apply centralised routing rules (such as a firewall inspection) to all traffic passing through the hub.
Routing is handled by route tables. A route table contains a set of rules (called routes) that tell the traffic where to go. For example, if a server in a VPC (with IP address range 10.0.0.0/16) wants to talk to a server in the on-premises network (with IP address 192.168.1.0/24), the route table must contain a route that says "for traffic destined to 192.168.1.0/24, send it to the virtual private gateway or transit gateway." You can also control traffic with security groups (stateful firewalls at the instance level) and network ACLs (stateless firewalls at the subnet level).
Security considerations are vital. You should encrypt traffic in transit (already handled by IPsec VPN), restrict access with least privilege principles, use AWS Identity and Access Management (IAM) to control who can modify network configurations, and monitor connectivity with Amazon CloudWatch and VPC Flow Logs (records of all IP traffic). For the exam, you also need to understand how to achieve high availability: deploy redundant customer gateways, use multiple VPN tunnels, and provision two Direct Connect connections to different AWS Direct Connect locations.
In summary, designing secure VPC connectivity and hybrid networking means choosing the right combination of VPN, Direct Connect, and transit gateway to match your business requirements for speed, security, cost, and resilience. The goal is to extend your on-premises network boundaries into the cloud safely and reliably.
Assess connectivity requirements
Determine whether you need a VPN, Direct Connect, or both. Evaluate latency tolerance, bandwidth needs, security compliance, and whether the connection is temporary or permanent.
Set up the Customer Gateway
Configure a physical or virtual router appliance in your on-premises data centre. This device will authenticate with AWS and terminate the VPN tunnel or BGP session.
Create a Virtual Private Gateway
Create a VGW in the AWS Management Console and attach it to your target VPC. This is the AWS-side termination point for VPN or Direct Connect traffic.
Establish the Connection
For VPN: create the Site-to-Site VPN connection, download the configuration file, and import it into your customer gateway. For Direct Connect: provision the connection through a network provider, create a Virtual Interface (VLAN), and configure BGP on both ends.
Configure Route Tables and Enable Route Propagation
Add routes in your VPC route table pointing to the virtual private gateway for on-premises prefixes. Enable route propagation so that BGP-learned routes automatically populate the route table.
Test Connectivity and Monitor
Ping an EC2 instance from an on-premises server and vice versa. Enable VPC Flow Logs and CloudWatch alarms to monitor latency, throughput, and link status. Test failover by simulating a connection drop.
An IT professional working for a mid-sized financial services firm needs to connect the company's main office in London to its new AWS account in the EU (Ireland) region. The firm processes sensitive customer financial data, so the connection must be secure, reliable, and compliant with financial regulations.
First, the professional assesses the requirements. The on-premises network uses IP addresses 10.0.0.0/16. The VPC in AWS will use 172.16.0.0/16. There are about 50 users who need access to a new customer portal hosted on EC2 instances, plus a database server that needs to be synchronised with the on-premises accounting system every hour. Latency must be under 10 milliseconds, and the connection must never go down during business hours.
The professional decides to provision an AWS Direct Connect connection for the primary link. They contact a network provider like BT or Colt and order a fibre line from their London data centre to an AWS Direct Connect location in the Docklands area. This process takes about six to eight weeks to install and test. During this time, they also set up a Site-to-Site VPN as a temporary measure and as the failover backup.
Once the Direct Connect line is live, the professional configures a virtual private gateway on the AWS side and attaches it to the VPC. They configure the on-premises router (customer gateway) with the two-way Authentication using Border Gateway Protocol (BGP), a routing protocol that automatically exchanges route information between the on-premises router and the AWS router. They set up two separate Virtual LANs (VLANs) over the Direct Connect cable: one for production traffic and one for development traffic, each with its own bandwidth allocation.
Next, they create a transit gateway. They attach both the VPC and the virtual private gateway to this transit gateway. This allows them to add more VPCs later (for example, a disaster recovery VPC in another region) without reconfiguring every connection. They also configure a network firewall appliance (from the AWS Marketplace) between the transit gateway and the VPC to inspect all incoming traffic for threats.
Finally, they set up monitoring. They enable VPC Flow Logs to capture all IP traffic metadata (who talked to whom, when, and on which port). They create an Amazon CloudWatch alarm that triggers if the Direct Connect link goes down for more than five minutes, automatically failing over to the VPN tunnel. They also run regular Amazon Inspector scans on the EC2 instances to ensure there are no vulnerabilities. The entire setup is documented in a change management ticket and reviewed by the security team.
The SAP-C02 exam tests your ability to design secure hybrid networking architectures that are highly available, cost-optimised, and compliant. Expect scenario-based questions where you must choose the right combination of VPN, Direct Connect, and transit gateway to meet specific requirements. The exam often sets traps by offering solutions that are technically possible but violate security best practices or cost constraints.
Key concepts the exam loves:
Differences between VPN and Direct Connect (including provisioning time, cost, latency, security, and use cases).
How to achieve high availability: redundant customer gateways, multiple VPN tunnels to two different AWS endpoints, two Direct Connect connections to different locations, and automatic failover with BGP.
Transit gateway architecture: when to use a transit gateway versus VPC peering, how transit gateway route tables work, and how to use transit gateway attachments to connect on-premises networks.
BGP routing: understanding that BGP is the standard routing protocol used with Direct Connect and VPN to exchange routes dynamically and detect link failures.
Connection scaling: using link aggregation groups (LAG) on Direct Connect to increase bandwidth by combining multiple fibre connections.
Encryption requirements: recognising that Direct Connect does not encrypt traffic by default, so if encryption is required, you must layer a VPN over Direct Connect or use encryption at the application level.
Common traps in SAP-C02:
Choosing a VPN when the question states low latency cannot vary (VPN uses the public internet, so latency fluctuates).
Selecting Direct Connect but ignoring that it takes weeks to provision (if the scenario demands immediate setup, VPN is the only option).
Proposing a single customer gateway for a production workload (the correct answer always involves redundancy).
Forgetting to enable BGP for automatic failover detection (static routes require manual intervention).
Assuming Direct Connect is always more secure because it is private, but the exam will remind you that you still need to encrypt sensitive data in transit.
The exam also tests your ability to read a network diagram and identify missing components (e.g., no VPN backup for a Direct Connect link, no route propagation between VPC and transit gateway). You should memorise the default limits (e.g., number of VPCs per transit gateway, number of Direct Connect connections per AWS account) and how to request increases.
Practice questions will ask: "Which combination of services provides the most secure and cost-effective hybrid connectivity?" or "What must be configured to ensure automatic failover?" The correct pattern is often: one Direct Connect, one VPN backup, BGP on both, and a transit gateway for centralised routing.
A Site-to-Site VPN is quick to set up and uses IPsec encryption but relies on the public internet, so it is subject to variable latency and throughput.
AWS Direct Connect provides a private, consistent, low-latency connection but requires weeks to provision and does not encrypt traffic by default.
For production hybrid networks, always design for high availability by deploying redundant connections (multiple VPN tunnels or two Direct Connect links).
A transit gateway acts as a central hub that simplifies routing between many VPCs and on-premises networks, replacing complex VPC peering meshes.
Border Gateway Protocol (BGP) is used with VPN and Direct Connect to exchange routes automatically and detect failures for automatic failover.
Network ACLs and security groups both control traffic but are different: NACLs are stateless and operate at the subnet level, while security groups are stateful and operate at the instance level.
These come up on the exam all the time. Here's how to tell them apart.
Virtual Private Gateway (VGW)
Connects a single VPC to on-premises networks using one VPN or Direct Connect attachment.
Limited scalability; you need multiple VGWs for multiple VPCs.
Lower management overhead for a single VPC scenario.
Transit Gateway
Acts as a central hub connecting many VPCs and on-premises networks simultaneously.
Highly scalable; you can attach hundreds of VPCs and thousands of routes.
Higher operational complexity but essential for multi-VPC, multi-Region architectures.
AWS Site-to-Site VPN
Uses the public internet as the transport medium, data is encrypted with IPsec.
Can be set up in minutes; low initial cost.
Latency and throughput vary depending on internet conditions.
AWS Direct Connect
Uses a dedicated private fibre connection; data is not encrypted by default.
Takes weeks to provision; higher monthly cost.
Provides consistent, low latency and high throughput with Service Level Agreements (SLAs).
Network ACL (NACL)
Stateless: you must define separate inbound and outbound rules independently.
Operates at the subnet level, affecting all instances in that subnet.
Evaluates rules in order (lowest number first) and has an explicit deny-all at the end.
Security Group
Stateful: if you allow inbound traffic, the return outbound traffic is automatically allowed.
Operates at the instance level, acting as a virtual firewall for each resource.
Only has allow rules; all traffic not explicitly allowed is implicitly denied.
Mistake
A Site-to-Site VPN is completely private because it uses encryption, so it is equivalent in security to Direct Connect.
Correct
A VPN encrypts the data payload, but the traffic still travels over the public internet, which means it can experience variable latency, packet loss, and potential side-channel attacks. Direct Connect avoids the public internet entirely, offering lower latency and more consistent performance, but it does not encrypt by default.
People conflate encryption with physical isolation. They assume encryption alone makes the connection as secure as a private line, not understanding that encryption protects the data only if it is properly implemented and that physical access to the internet path can still lead to denial-of-service or performance issues.
Mistake
You should always use Virtual Private Gateway for connecting a single VPC to on-premises because it is simpler and cheaper than a transit gateway.
Correct
A virtual private gateway is fine for a single VPC, but if you ever need to connect multiple VPCs or multiple on-premises locations, a transit gateway reduces operational complexity and cost by centralising routing.
Beginners learn the simple setup first (VPC + VGW) and do not anticipate future growth. They think 'simpler now' equals 'correct answer', ignoring the exam's focus on scalable architectures.
Mistake
Direct Connect automatically encrypts all traffic between the data centre and AWS.
Correct
Direct Connect provides a private physical connection, but it does not encrypt the data. If encryption is required, you must add a VPN layer on top of the Direct Connect link or encrypt at the application/transport layer (e.g., TLS).
The term 'private connection' implies security. Many assume 'private' equals 'encrypted' without reading the documentation or understanding that physical access to the fibre is still possible.
Mistake
If you use a single Direct Connect connection with a single device at each end, it is sufficient for a production workload because Direct Connect is highly reliable.
Correct
A single Direct Connect connection creates a single point of failure. For high availability, you need at least two connections to two different AWS Direct Connect locations and redundant customer gateway devices.
Beginners underestimate the probability of a fibre cut or device failure. They rely on the service provider's promise of reliability rather than designing for failure.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A VPN uses the public internet and is quick to set up but has variable latency. Direct Connect is a private, dedicated fibre connection with consistent low latency but takes weeks to provision and costs more.
Yes, both require a virtual private gateway attached to the VPC to terminate the connection. For transit gateway architectures, you attach the VGW to the transit gateway instead.
Yes, by using a transit gateway. You attach the virtual private gateway (for the on-premises side) and all your VPCs to the transit gateway, which routes traffic between them centrally.
BGP is a dynamic routing protocol that automatically exchanges routing information and detects link failures. It is used with Direct Connect and VPN so that your network automatically uses alternative paths when a link goes down.
Use at least two independent physical connections (either two Direct Connect lines or one Direct Connect plus a VPN backup) connected to different devices and locations. Enable BGP to automate failover.
No, Direct Connect provides a private physical circuit but does not encrypt traffic. If you need encryption, you must set up a VPN tunnel over the Direct Connect link or use application-layer encryption.
You've finished Designing Secure VPC Connectivity and Hybrid Networking. Continue through the SAP-C02 study guide to build a complete picture of the exam.
Done with this chapter?