2.3.1.2. Hybrid Cloud Connectivity (Direct Connect, VPN)

💡 First Principle: Securely and reliably extending an on-premises network to the cloud is fundamental for creating seamless hybrid environments that bridge existing infrastructure with cloud resources.

Scenario: A large enterprise needs to transfer several petabytes of historical data from its on-premises data center to "Amazon S3" for a new data lake. The data transfer must be highly secure, consistently fast, and bypass the public internet.

Hybrid cloud architectures require robust connectivity options to link on-premises data centers with AWS.

• "AWS Direct Connect": A cloud service solution that links your internal network to AWS over a dedicated, private connection.
  • Practical Relevance: Provides consistent network performance and lower latency than internet-based VPNs. Ideal for high-throughput workloads, real-time applications, large data transfers, and compliance-driven scenarios that require private connectivity. Offers various speeds ("1Gbps", "10Gbps", etc.) and can be configured as a hosted connection or dedicated port. Requires physical connection to a "Direct Connect location".
• "AWS Site-to-Site VPN": A managed VPN connection that creates an encrypted tunnel between your on-premises network and your "Amazon VPC" over the public internet.
  • Practical Relevance: More flexible and faster to set up than "Direct Connect". Suitable for many use cases including disaster recovery, small-to-medium data transfers, or connections where consistent performance isn't the absolute highest priority. Uses "IPsec" for encryption. Can be highly available with two tunnels.

Visual: Hybrid Cloud Connectivity (Direct Connect vs. Site-to-Site VPN)

Loading diagram...

⚠️ Common Pitfall: Relying on a single "Direct Connect" connection for a mission-critical hybrid workload. A single physical link is a single point of failure. Best practice is to have a redundant "Direct Connect" link or a backup "Site-to-Site VPN" connection.

Key Trade-Offs:

• Performance/Security ("Direct Connect") vs. Cost/Flexibility ("VPN"): "Direct Connect" offers superior, consistent performance and security but comes with higher costs and longer setup times. A "Site-to-Site VPN" is cheaper and faster to deploy but relies on the public internet, leading to variable performance.

Reflection Question: Why would "AWS Direct Connect" be the most appropriate primary connectivity solution for transferring several petabytes of historical data from an on-premises data center to "Amazon S3", ensuring high security and consistent speed? What role could "AWS Site-to-Site VPN" play for resilience in this scenario?