AWS Direct Connect vs VPN

• AWS VPN Connection utilizes IPSec to establish encrypted network connectivity between the intranet and VPC over the Internet.
• AWS Direct Connect provides dedicated, private network connections between the intranet and VPC.
• Setup time
  • VPN Connections can be configured in minutes and are a good solution for immediate needs, have low to modest bandwidth requirements, and can tolerate the inherent variability in Internet-based connectivity.
  • Direct Connect can take anywhere from 4 to 12 weeks
• Routing
  • VPN traffic is still routed through the Internet.
  • Direct Connect does not involve the Internet; instead, it uses dedicated, private network connections between the intranet and VPC. The network traffic remains on the AWS global network and never touches the public internet. This reduces the chance of hitting bottlenecks or unexpected increases in latency
• Bandwidth
  • VPN connections support up to 1.25 Gbps per tunnel (standard) or 5 Gbps per tunnel (large bandwidth tunnels, launched Nov 2025). With ECMP on Transit Gateway, multiple tunnels can be aggregated for higher throughput.
  • Direct Connect supports dedicated connections at 1 Gbps, 10 Gbps, 100 Gbps, or 400 Gbps (native 400 Gbps launched Jul 2024 at select locations). Hosted connections are available from 50 Mbps up to 25 Gbps via AWS Direct Connect Partners.
• Cost
  • VPN connections are relatively inexpensive — standard 1.25 Gbps connections cost $0.05/hr (~$36/month) per connection. The 5 Gbps large bandwidth tunnels cost $0.60/hr (~$432/month). Additional charges apply for data transfer out and Transit Gateway attachments.
  • Direct Connect requires actual hardware and infrastructure — port-hour charges vary by speed (e.g., 1 Gbps, 10 Gbps, 100 Gbps, 400 Gbps) plus data transfer charges. Total costs can run into thousands per month depending on port speed and data volumes.
• Encryption in Transit
  • VPN connections encrypt the data in transit using IPSec.
  • Direct Connect data transfer can be encrypted using:
    • MACsec (IEEE 802.1AE) — Layer 2 encryption on dedicated connections (1 Gbps, 10 Gbps, 100 Gbps, 400 Gbps) and supported partner interconnects (extended Jul 2025).
    • Private IP VPN — IPSec encryption over Direct Connect transit VIFs, providing end-to-end encryption without using public VIFs or public IP addresses.
• Resiliency
  • VPN provides built-in high availability with two tunnels per connection across multiple Availability Zones. Accelerated VPN uses AWS Global Accelerator for optimized routing.
  • Direct Connect offers the Resiliency Toolkit with connection wizard supporting Maximum Resiliency, High Resiliency, and Development/Test models. SiteLink enables direct data transfer between Direct Connect locations bypassing AWS Regions.

Direct Connect vs VPN Comparison

AWS VPN Connection Types (Updated 2025)

As of November 2025, AWS Site-to-Site VPN offers five distinct connection options:

• Standard 1.25 Gbps VPN — Up to 1.25 Gbps per tunnel; terminates on Virtual Private Gateway (VGW) or Transit Gateway. Supports ECMP for higher aggregate bandwidth when used with Transit Gateway.
• 5 Gbps Large Bandwidth VPN (Nov 2025) — Up to 5 Gbps per tunnel; terminates on Transit Gateway only. Ideal for bandwidth-intensive hybrid applications, big data migrations, and disaster recovery. Existing tunnels can be upgraded in-place (May 2026) without changing IP addresses or configuration.
• Accelerated VPN — Uses AWS Global Accelerator to route traffic from on-premises to the nearest AWS edge location, reducing internet path variability. Available for both 1.25 Gbps connections.
• VPN Concentrator (Nov 2025) — Simplifies multi-site connectivity for 25+ remote sites (each under 100 Mbps). Single Transit Gateway attachment for all sites with 5 Gbps aggregate bandwidth. Cost-effective for distributed enterprises (retail, hospitality, healthcare).
• Private IP VPN — IPSec VPN over Direct Connect transit VIFs using private IP addresses. Provides encryption on dedicated connections without traversing the public internet.

AWS Direct Connect + VPN

• AWS Direct Connect + VPN combines the benefits of the end-to-end secure IPSec connection with low latency and increased bandwidth of the AWS Direct Connect to provide a more consistent network experience than internet-based VPN connections.
• Two approaches are available:
  • Public VIF approach (legacy) — Direct Connect public VIF establishes a dedicated network connection between the on-premises network to public AWS resources, such as an Amazon virtual private gateway IPsec endpoint. A BGP connection is established on the public VIF, and another BGP session or static route is established on the IPSec VPN tunnel.
  • Private IP VPN (recommended) — Uses Direct Connect transit VIFs with private IP addresses to establish IPSec connections to Transit Gateway. This eliminates the need for public IP addresses and keeps all traffic private end-to-end.

Direct Connect + VPN as Backup

• VPN can be selected to provide a quick and cost-effective, backup hybrid network connection to an AWS Direct Connect. However, it provides a lower level of reliability and indeterministic performance over the internet.
• Be sure that you use the same virtual private gateway for both Direct Connect and the VPN connection to the VPC.
• If you are configuring a Border Gateway Protocol (BGP) VPN, advertise the same prefix for Direct Connect and the VPN.
• If you are configuring a static VPN, add the same static prefixes to the VPN connection that you are announcing with the Direct Connect virtual interface.
• If you are advertising the same routes toward the AWS VPC, the Direct Connect path is always preferred, regardless of AS path prepending.
• For Transit Gateway architectures, both Direct Connect (via Direct Connect Gateway) and VPN can attach to the same Transit Gateway with route table preferences configured appropriately.

AWS Direct Connect SiteLink

• SiteLink enables sending data from one Direct Connect location to another, bypassing AWS Regions entirely.
• Useful for building a private, low-latency global backbone between on-premises data centers using the AWS global network.
• Traffic flows between Direct Connect locations over the shortest available path on the AWS backbone without being routed through any AWS Region.
• Enabled per virtual interface — only SiteLink-enabled VIFs can communicate with each other.
• Combined with MACsec encryption, provides a secure and private global WAN over AWS infrastructure.

AWS Certification Exam Practice Questions

• Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
• AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
• AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
• Open to further feedback, discussion and correction.

1. You work as an AWS Architect for a company that has an on-premise data center. They want to connect their on-premise infra to the AWS Cloud. Note that this connection must have the maximum throughput and be dedicated to the company. How can this be achieved?
   1. Use AWS Express Route
   2. Use AWS Direct Connect
   3. Use AWS VPC Peering
   4. Use AWS VPN
2. A company wants to set up a hybrid connection between their AWS VPC and their on-premise network. They need to have high bandwidth and less latency because they need to transfer their current database workloads to AWS. Which of the following would you use for this purpose?
   1. AWS Managed software VPN
   2. AWS Managed hardware VPN
   3. AWS Direct Connect
   4. AWS VPC Peering
3. An organization has established an Internet-based VPN connection between their on-premises data center and AWS. They are considering migrating from VPN to AWS Direct Connect. Which operational concern should drive an organization to consider switching from an Internet-based VPN connection to AWS Direct Connect?
   1. AWS Direct Connect provides greater redundancy than an Internet-based VPN connection.
   2. AWS Direct Connect provides greater resiliency than an Internet-based VPN connection.
   3. AWS Direct Connect provides greater bandwidth than an Internet-based VPN connection.
   4. AWS Direct Connect provides greater control of network provider selection than an Internet-based VPN connection.
4. A company needs to encrypt data in transit over their existing AWS Direct Connect connection. They want to use private IP addresses and avoid routing traffic over the public internet. Which solution should they implement?
   1. Configure MACsec encryption on the Direct Connect connection.
   2. Create a VPN connection over a Direct Connect public VIF.
   3. Create a Private IP VPN connection over a Direct Connect transit VIF.
   4. Use AWS CloudHSM to encrypt data before transmission.
5. A retail company has 200 store locations across the country, each requiring under 50 Mbps bandwidth to access centralized applications in AWS. They want to minimize the number of Transit Gateway attachments and reduce costs. Which VPN solution is most appropriate?
   1. Create 200 individual Site-to-Site VPN connections to Transit Gateway.
   2. Use AWS Client VPN for each store location.
   3. Use AWS Site-to-Site VPN Concentrator to connect all sites through a single Transit Gateway attachment.
   4. Set up AWS Direct Connect for each store location.
6. A company requires a single encrypted VPN connection with bandwidth exceeding 2 Gbps for disaster recovery replication to AWS. They want the simplest architecture with the fewest connections. Which solution meets these requirements?
   1. Create two standard 1.25 Gbps VPN connections with ECMP enabled.
   2. Use AWS Direct Connect with MACsec encryption.
   3. Create a 5 Gbps Site-to-Site VPN connection to Transit Gateway.
   4. Create four standard VPN connections with load balancing.
7. A company uses AWS Direct Connect as their primary connection and Site-to-Site VPN as backup. Both connections advertise the same routes. Which path will AWS prefer for traffic from the VPC to on-premises?
   1. The path with the shortest AS path length.
   2. The VPN connection because it is encrypted.
   3. The Direct Connect path is always preferred, regardless of AS path prepending.
   4. Traffic is load balanced between both connections.