AWS Direct Connect vs VPN

• AWS VPN Connection utilizes IPSec to establish encrypted network connectivity between the intranet and VPC over the Internet.
• AWS Direct Connect provides dedicated, private network connections between the intranet and VPC.
• Setup time
  • VPN Connections can be configured in minutes and are a good solution for immediate needs, have low to modest bandwidth requirements, and can tolerate the inherent variability in Internet-based connectivity.
  • Direct Connect can take anywhere from 4 to 12 weeks
• Routing
  • VPN traffic is still routed through the Internet.
  • Direct Connect does not involve the Internet; instead, it uses dedicated, private network connections between the intranet and VPC. The network traffic remains on the AWS global network and never touches the public internet. This reduces the chance of hitting bottlenecks or unexpected increases in latency
• Cost
  • VPN connections are very cheap ($37.20/month as of now)
  • Direct Connect connection as it requires actual hardware and infrastructure and might go in thousands.
• Encryption in Transit
  • VPN connections encrypt the data in transit.
  • Direct Connect data transfer can now be encrypted using MACsec, however, comes with limitations in terms of supported speed and locations.

Direct Connect vs VPN Comparison

AWS Direct Connect + VPN

• AWS Direct Connect + VPN combines the benefits of the end-to-end secure IPSec connection with low latency and increased bandwidth of the AWS Direct Connect to provide a more consistent network experience than internet-based VPN connections.
• AWS Direct Connect public VIF establishes a dedicated network connection between the on-premises network to public AWS resources, such as an Amazon virtual private gateway IPsec endpoint.
• A BGP connection is established between the AWS Direct Connect and your router on the public VIF.
• Another BGP session or a static router will be established between the virtual private gateway and your router on the IPSec VPN tunnel.

Direct Connect + VPN as Backup

• VPN can be selected to provide a quick and cost-effective, backup hybrid network connection to an AWS Direct Connect. However, it provides a lower level of reliability and indeterministic performance over the internet
• Be sure that you use the same virtual private gateway for both Direct Connect and the VPN connection to the VPC.
• If you are configuring a Border Gateway Protocol (BGP) VPN, advertise the same prefix for Direct Connect and the VPN.
• If you are configuring a static VPN, add the same static prefixes to the VPN connection that you are announcing with the Direct Connect virtual interface.
• If you are advertising the same routes toward the AWS VPC, the Direct Connect path is always preferred, regardless of AS path prepending.

AWS Certification Exam Practice Questions

• Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
• AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
• AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
• Open to further feedback, discussion and correction.

1. You work as an AWS Architect for a company that has an on-premise data center. They want to connect their on-premise infra to the AWS Cloud.  Note that this connection must have the maximum throughput and be dedicated to the company. How can this be achieved?
   1. Use AWS Express Route
   2. Use AWS Direct Connect
   3. Use AWS VPC Peering
   4. Use AWS VPN
2. A company wants to set up a hybrid connection between their AWS VPC and their on-premise network. They need to have high bandwidth and less latency because they need to transfer their current database workloads to AWS. Which of the following would you use for this purpose?
   1. AWS Managed software VPN
   2. AWS Managed hardware VPN
   3. AWS Direct Connect
   4. AWS VPC Peering
3. An organization has established an Internet-based VPN connection between their on-premises data center and AWS. They are considering migrating from VPN to AWS Direct Connect. Which operational concern should drive an organization to consider switching from an Internet-based VPN connection to AWS Direct Connect?
   1. AWS Direct Connect provides greater redundancy than an Internet-based VPN connection.
   2. AWS Direct Connect provides greater resiliency than an Internet-based VPN connection.
   3. AWS Direct Connect provides greater bandwidth than an Internet-based VPN connection.
   4. AWS Direct Connect provides greater control of network provider selection than an Internet-based VPN connection.