AWS Direct Connect

AWS Direct Connect is a cloud service that makes it easy to establish a dedicated network connection from your on-premises data center to AWS. Think of it as a private, high-speed fiber-optic cable that bypasses the public internet. The primary problem it solves is the unpredictability and potential security risks of internet-based connections. When you use a standard internet connection to access AWS services, your traffic travels over the public internet, which is shared with millions of other users. This can lead to variable latency, jitter, packet loss, and bandwidth contention. For latency-sensitive workloads (e.g., real-time gaming, financial trading) or high-volume data transfers (e.g., large-scale backups, disaster recovery), the public internet is often unreliable. Direct Connect provides a consistent network experience, lower latency, and higher security by keeping traffic off the internet.

To use Direct Connect, you must first establish a physical connection between your network and an AWS Direct Connect location. These are specialized data centers co-located with AWS partner facilities (e.g., Equinix, Digital Realty) in major metropolitan areas around the world. You work with an AWS Direct Connect Partner (a telecom or colocation provider) to order a cross-connect—a physical cable that links your router in the facility to an AWS Direct Connect router. Once the physical connection is in place, you create a Virtual Interface (VLAN) on top of it. There are two types: a private VIF (for connecting to your Amazon VPC via a Virtual Private Gateway) and a public VIF (for connecting to AWS public services like S3, DynamoDB, or EC2 in any region, but still over the dedicated link). The private VIF uses 802.1Q VLAN tagging and BGP (Border Gateway Protocol) to route traffic between your on-premises network and your VPC. You must configure BGP sessions with your own public or private ASN, and you can use multiple VLANs to connect to multiple VPCs or multiple AWS accounts.

Direct Connect offers two port speeds: 1 Gbps and 10 Gbps. For higher bandwidth, you can use Link Aggregation Groups (LAGs) to combine multiple connections. Pricing is based on the port speed and the data transfer out (egress) from AWS. You pay an hourly fee for the port (e.g., ~$0.30/hour for 1 Gbps) plus a per-GB charge for data transferred out. Data transferred into AWS (ingress) is free. There is also a data transfer discount: if you commit to a minimum monthly data transfer volume (e.g., 10 TB), you can get lower per-GB rates. Additionally, you can purchase a Direct Connect Gateway, which allows you to connect to multiple VPCs in multiple AWS regions using a single Direct Connect connection. This is a key concept for the exam: a Direct Connect Gateway is a global resource that acts as a hub, enabling BGP routing between your on-premises network and multiple VPCs across regions.

Before Direct Connect, organizations typically used IPsec VPNs over the internet to connect to AWS. VPNs are easier to set up (no physical infrastructure) and cheaper for low-bandwidth needs, but they suffer from internet variability. Direct Connect provides a more consistent, lower-latency experience. Another alternative is AWS Site-to-Site VPN, which can be used as a backup to Direct Connect. For hybrid architectures, many enterprises use both: Direct Connect as the primary link and VPN as a failover. On the exam, be aware that Direct Connect is not a VPN; it is a physical, dedicated connection. Also, note that Direct Connect does not encrypt data by default—you must add encryption at the application layer or use IPsec over Direct Connect (which is supported but adds complexity).

Use Direct Connect when:

Use VPN when:

Use AWS Transit Gateway with VPN or Direct Connect when you have many VPCs and on-premises networks that need to interconnect.

Scenario 1: Financial Services Firm with Latency-Sensitive Trading A hedge fund runs automated trading algorithms on AWS that require sub-millisecond latency to regional exchanges. Using a VPN over the internet introduces unpredictable latency spikes during market volatility, causing trades to fail. The firm orders a 10 Gbps Direct Connect connection from its co-location facility in New Jersey to an AWS Direct Connect location in the same building. By configuring a private VIF to a VPC containing their trading engines, they achieve consistent 0.5ms latency. They also set up a backup VPN connection for failover. Cost: ~$2,000/month for the port plus data transfer egress. The firm saves millions by avoiding missed trades.

Scenario 2: Media Company Transferring Large Video Files A video streaming service needs to upload hundreds of terabytes of raw footage daily to AWS S3 for processing. Internet uploads are slow and unreliable—often failing mid-transfer. They order a 1 Gbps Direct Connect connection and create a public VIF to access S3 endpoints directly. The dedicated link provides consistent 900 Mbps throughput, cutting upload time from days to hours. They use AWS DataSync over Direct Connect to automate transfers. Cost: ~$300/month for the port plus egress fees. The company avoids costly internet bandwidth upgrades and reduces transfer errors.

Scenario 3: Healthcare Provider with Compliance Requirements A hospital system must comply with HIPAA, which requires that patient data not traverse the public internet when connecting to AWS. They order a Direct Connect connection to a local AWS Direct Connect location. They configure a private VIF to a VPC hosting their electronic health records (EHR) system. All traffic stays within the private network, satisfying compliance. They also enable encryption at the application layer using TLS. When the hospital's IT team misconfigures the BGP route filters, traffic is black-holed, and the EHR system becomes unreachable for two hours. This highlights the need for proper BGP community tagging and monitoring with Amazon CloudWatch.