AWS Hybrid Cloud Networking Architecture — Overview
Hybrid cloud networking connects on-premises data centers to AWS, enabling workload migration, burst capacity, disaster recovery, and multi-cloud strategies. The architecture must balance bandwidth, latency, cost, encryption, and redundancy. This is a core focus area for SAP-C02 and the Advanced Networking Specialty (ANS-C01).
1/10/100 Gbps
Private + Public VIF
Dedicated fiber
IPSec over internet
1.25 Gbps/tunnel
Encrypted
Route tables for segmentation | Multi-region peering
App tier
DB tier
Isolated
workloads
DNS, AD
Endpoints
NAT GW
Firewall
Inbound + Outbound
Hybrid DNS
AWS services
without internet
L3-L7 inspection
IDS/IPS
Connectivity Options Compared
| Aspect | Direct Connect | Site-to-Site VPN | Client VPN |
|---|---|---|---|
| Connection | Dedicated physical fiber via DX location | IPSec tunnels over public internet | OpenVPN for individual users |
| Bandwidth | 1, 10, or 100 Gbps (dedicated) / 50Mbps-10Gbps (hosted) | Up to 1.25 Gbps per tunnel (use ECMP for more) | Per-user bandwidth |
| Latency | Consistent, low (private path) | Variable (internet-dependent) | Variable |
| Encryption | NOT encrypted by default (add VPN over DX for encryption) | Encrypted (IPSec) | Encrypted (TLS) |
| Setup time | Weeks-months (physical cross-connect) | Minutes (software configuration) | Minutes |
| Redundancy | Requires 2 connections at 2 DX locations for HA | 2 tunnels per VPN (2 AZs) automatically | Multi-AZ endpoint |
| Cost | Port-hour + data transfer out (cheaper egress than internet) | Per VPN connection-hour + data transfer | Per connection-hour + per subnet association |
When to Use Which
- Direct Connect: Large data transfers (TB+), consistent low-latency requirements, reduced egress costs, compliance requiring private connectivity
- Site-to-Site VPN: Quick setup, encrypted by default, backup for Direct Connect, low-moderate bandwidth needs
- DX + VPN together: Encryption over private connection (Direct Connect provides bandwidth + VPN provides encryption)
- Client VPN: Individual remote users needing access to VPC resources (being replaced by Verified Access for Zero Trust)
AWS Transit Gateway — Central Hub
Transit Gateway is the single point of connectivity for all VPCs, VPNs, Direct Connect, and peered Transit Gateways:
- Hub-and-spoke: All VPCs attach to TGW instead of meshing VPC peering (N² problem → N attachments)
- Route tables: Separate route tables for network segmentation (Prod, Dev, Shared Services — control who talks to whom)
- Multi-region: Transit Gateway Peering connects TGWs across regions (inter-region traffic stays on AWS backbone)
- ECMP: Equal-Cost Multi-Path across VPN tunnels for aggregate bandwidth (e.g., 4 tunnels × 1.25 Gbps = 5 Gbps)
- Multicast: TGW supports multicast for financial/media workloads
- Appliance mode: Ensures symmetric routing when traffic passes through a virtual appliance (firewall) in a VPC
Direct Connect Architecture
Virtual Interfaces (VIFs)
| VIF Type | Purpose | Connects To |
|---|---|---|
| Private VIF | Access VPC resources via private IP | VGW (single VPC) or Direct Connect Gateway → TGW (multiple VPCs) |
| Public VIF | Access AWS public services (S3, DynamoDB) via private path | AWS public IP ranges (avoids internet) |
| Transit VIF | Connect to Transit Gateway (access all attached VPCs) | Direct Connect Gateway → Transit Gateway |
High Availability for Direct Connect
- Maximum resilience: 2 DX connections at 2 separate DX locations (protects against location failure)
- High resilience: 2 DX connections at 1 DX location (protects against device failure)
- DX + VPN backup: Direct Connect as primary, Site-to-Site VPN as failover (via BGP priority)
- LAG (Link Aggregation): Bundle multiple connections at same location for aggregate bandwidth
Hybrid DNS — Route 53 Resolver
Hybrid DNS ensures name resolution works seamlessly between on-premises and AWS:
- Inbound Endpoint: On-premises DNS servers forward queries for AWS-hosted domains (e.g., *.aws.internal) → Route 53 Resolver resolves them
- Outbound Endpoint: AWS resources query on-premises domains (e.g., corp.example.com) → Route 53 Resolver forwards to on-premises DNS
- Resolver Rules: Define which domains forward where (conditional forwarding)
- RAM sharing: Share Resolver Rules across accounts so all VPCs in the org resolve hybrid DNS consistently
Centralized Egress & Inspection
Instead of NAT Gateway per VPC (expensive), centralize in a dedicated egress VPC:
- Egress VPC: Contains NAT Gateways + AWS Network Firewall
- TGW routing: All VPCs’ 0.0.0.0/0 route points to TGW → TGW routes to Egress VPC
- Network Firewall: Inspects all outbound traffic (domain filtering, IDS/IPS, stateful rules)
- Cost savings: One set of NAT Gateways shared across all VPCs vs per-VPC NATs
Multi-Region Networking
- Transit Gateway Peering: Connect TGWs across regions for inter-region VPC communication (static routes)
- Direct Connect Gateway: Single DX connection → access VPCs in multiple regions (via TGW in each region)
- Global Accelerator: Anycast IPs that route to nearest healthy AWS endpoint (for multi-region failover)
- CloudFront: Edge caching for static/dynamic content, reducing latency for global users
Exam Tips by Certification
| Exam | Focus Areas |
|---|---|
| SAP-C02 | DX vs VPN selection, TGW route table segmentation, centralized egress/inspection, hybrid DNS (Resolver endpoints), DX+VPN for encrypted private connectivity, multi-region networking patterns |
| ANS-C01 | DX VIF types (Private/Public/Transit), BGP routing (AS-path prepending, MED), LAG, DX Gateway, DX resiliency models, TGW multicast, ECMP over VPN, flow logs analysis |
AWS Certification Exam Practice Questions
Question 1:
A company has a 10 Gbps Direct Connect connection for production traffic. They need encrypted connectivity to AWS for compliance, but Direct Connect is not encrypted by default. What is the MOST bandwidth-efficient solution?
- Replace Direct Connect with Site-to-Site VPN (encrypted by default)
- Create a Site-to-Site VPN over the Direct Connect connection (VPN over DX using public VIF)
- Enable MACsec encryption on the Direct Connect connection
- Use AWS CloudHSM to encrypt all traffic at the application layer
Show Answer
Answer: C – MACsec (IEEE 802.1AE) provides native Layer 2 encryption on Direct Connect at line speed with no bandwidth penalty. It’s available on 10 Gbps and 100 Gbps dedicated connections. VPN over DX works but is limited to 1.25 Gbps per tunnel and adds overhead. MACsec encrypts the full 10 Gbps capacity without performance impact.
Question 2:
A company has 15 VPCs across 3 accounts. They need all VPCs to communicate with on-premises via a single Direct Connect connection, while keeping production VPCs isolated from development VPCs. What architecture achieves this?
- VPC Peering between all VPCs + Virtual Private Gateway per VPC
- Transit Gateway with separate route tables for Prod and Dev, connected to Direct Connect via DX Gateway
- Direct Connect with 15 Private VIFs (one per VPC)
- AWS PrivateLink between all VPCs and on-premises
Show Answer
Answer: B – Transit Gateway provides hub connectivity for all 15 VPCs with a single attachment to Direct Connect (via DX Gateway + Transit VIF). Route tables on TGW control segmentation: Prod route table has routes to on-prem + Prod VPCs (no Dev routes). Dev route table has routes to on-prem + Dev VPCs (no Prod routes). This scales without the N² peering problem.
Question 3:
A company’s on-premises applications need to resolve AWS private hosted zone DNS names (e.g., api.internal.company.com hosted in Route 53). Currently, on-premises DNS queries for these names fail. What should be configured?
- Create a public hosted zone and use public DNS resolution
- Configure Route 53 Resolver Inbound Endpoints in the VPC and forward on-premises DNS to them
- Replicate Route 53 records to on-premises DNS servers
- Configure Route 53 Resolver Outbound Endpoints with forwarding rules
Show Answer
Answer: B – Inbound Endpoints provide IP addresses in your VPC that on-premises DNS servers can forward queries to. When on-premises DNS receives a query for *.internal.company.com, it forwards to the Inbound Endpoint IPs → Route 53 Resolver resolves from the private hosted zone → returns the answer. Outbound is the reverse direction (AWS → on-prem DNS).
Question 4:
A company wants to access S3 and DynamoDB from on-premises without traversing the public internet. Their Direct Connect is already established. Which VIF type and configuration enables this?
- Private VIF to a VPC with VPC Gateway Endpoints for S3/DynamoDB
- Public VIF — advertises AWS public IP ranges over the DX connection
- Transit VIF with TGW routing to S3 endpoints
- Create an S3 VPC Interface Endpoint and route from on-prem via Private VIF
Show Answer
Answer: B – A Public VIF on Direct Connect advertises AWS public service IP ranges (including S3 and DynamoDB) over your private DX connection. Traffic reaches AWS public endpoints without using the internet — it travels over your dedicated fiber. This is the designed approach for accessing AWS public services privately. Gateway Endpoints are VPC-only (not accessible from on-prem directly).
Question 5:
A company needs maximum resilience for their Direct Connect connectivity. Their compliance requires surviving a complete DX location failure. What is the minimum configuration?
- Single DX connection with 2 Private VIFs
- 2 DX connections at the same DX location
- 2 DX connections at 2 different DX locations
- 1 DX connection + Site-to-Site VPN as backup
Show Answer
Answer: C – Maximum resilience requires connections at 2 separate DX locations. If one location has a complete failure (fire, power outage, fiber cut), the other location continues operating. 2 connections at the same location protects against device failure but not location failure. VPN backup provides resilience but with degraded performance (not maximum resilience for DX-grade traffic).
Related Posts
- AWS Virtual Private Cloud (VPC)
- AWS Direct Connect
- AWS VPC Explained – Beginners Guide
- Network Firewall vs WAF vs Security Groups vs NACLs
- AWS Multi-Account Architecture
- AWS Zero Trust Architecture
References
- AWS Hybrid Connectivity Whitepaper
- Single Internet Exit Point from Multiple VPCs Using Transit Gateway — AWS Blog
- Integrating Transit Gateway with Direct Connect — AWS Blog
- AWS Direct Connect Resiliency Recommendations
- Simplify DNS Management in Multi-Account with Route 53 Resolver — AWS Blog
Frequently Asked Questions
Is Direct Connect encrypted?
No, by default Direct Connect is NOT encrypted — it’s a private connection but data travels in cleartext. For encryption, either enable MACsec (Layer 2, line-speed, on 10/100 Gbps) or create a Site-to-Site VPN over the DX connection (IPSec, limited to 1.25 Gbps per tunnel). MACsec is preferred for high-bandwidth encrypted private connectivity.
Transit Gateway vs VPC Peering — when to use which?
Use VPC Peering for simple point-to-point connectivity between 2-3 VPCs (no transitive routing, lower cost). Use Transit Gateway when you have 4+ VPCs, need on-premises connectivity, require route segmentation, or need transitive routing. TGW scales better but costs more (per-attachment + data processing fee).
What is a Direct Connect Gateway?
A Direct Connect Gateway is a globally available resource that connects your DX connection to VPCs/TGWs in any AWS region (not just the region where the DX location resides). One physical DX connection → DX Gateway → access VPCs across multiple regions. It supports both Private VIFs (→ VGW) and Transit VIFs (→ TGW).