2.3.1.2. Hybrid Cloud Connectivity (Direct Connect, VPN)

2.3.1.2. Hybrid Cloud Connectivity (Direct Connect, VPN)

💡 First Principle: Securely and reliably extending an on-premises network to the cloud is fundamental for creating seamless hybrid environments that bridge existing infrastructure with cloud resources.

Scenario: A large enterprise needs to transfer several petabytes of historical data from its on-premises data center to "Amazon S3" for a new data lake. The data transfer must be highly secure, consistently fast, and bypass the public internet.

Hybrid cloud architectures require robust connectivity options to link on-premises data centers with AWS.

• "AWS Direct Connect": A cloud service solution that links your internal network to AWS over a dedicated, private connection.
  • Practical Relevance: Provides consistent network performance and lower latency than internet-based VPNs. Ideal for high-throughput workloads, real-time applications, large data transfers, and compliance-driven scenarios that require private connectivity. Offers various speeds ("1Gbps", "10Gbps", etc.) and can be configured as a hosted connection or dedicated port. Requires physical connection to a "Direct Connect location".
  • Direct Connect gateway (DXGW): A global resource that lets one Direct Connect connection reach VPCs in any Region and account (private VIF) or associate with Transit Gateways (transit VIF), so you do not need a separate connection per Region. Where traffic enters AWS matters for latency: a site connected only through a distant Region's Direct Connect location hairpins through that Region, so connections are placed near the sites and Regions that exchange the traffic.
  • Resiliency: One connection is a single point of failure. Maximum resiliency uses separate connections that terminate on separate devices in more than one Direct Connect location, ideally with diverse last-mile paths. A Link Aggregation Group (LAG) bundles ports at one location for bandwidth and port-level redundancy but does not survive the loss of that location. The most cost-effective backup is a Site-to-Site VPN, with BGP preferring the Direct Connect path.
  • Encryption: Direct Connect is private but not encrypted by default. Run an IPsec Site-to-Site VPN over the Direct Connect connection, or enable "MACsec" on supported dedicated connections, to encrypt in transit while keeping the dedicated path. Encrypting the destination S3 bucket with KMS does not encrypt the network path.
  • Addressing: The VPC CIDR must not overlap with on-premises ranges, or private routing across Direct Connect or VPN cannot work; choose non-overlapping ranges when the VPC is created.
• "AWS Site-to-Site VPN": A managed VPN connection that creates an encrypted tunnel between your on-premises network and your "Amazon VPC" over the public internet.
  • Practical Relevance: More flexible and faster to set up than "Direct Connect". Suitable for many use cases including disaster recovery, small-to-medium data transfers, or connections where consistent performance isn't the absolute highest priority. Uses "IPsec" for encryption. Can be highly available with two tunnels.

Visual: Hybrid Cloud Connectivity (Direct Connect vs. Site-to-Site VPN)

⚠️ Common Pitfall: Relying on a single "Direct Connect" connection for a mission-critical hybrid workload. A single physical link is a single point of failure. Best practice is to have a redundant "Direct Connect" link or a backup "Site-to-Site VPN" connection.

Key Trade-Offs:

• Performance/Security ("Direct Connect") vs. Cost/Flexibility ("VPN"): "Direct Connect" offers superior, consistent performance and security but comes with higher costs and longer setup times. A "Site-to-Site VPN" is cheaper and faster to deploy but relies on the public internet, leading to variable performance.

Reflection Question: Why would "AWS Direct Connect" be the most appropriate primary connectivity solution for transferring several petabytes of historical data from an on-premises data center to "Amazon S3", ensuring high security and consistent speed? What role could "AWS Site-to-Site VPN" play for resilience in this scenario?