Purpose of This Lesson

This lesson explains the principal ways to connect on-premises networks, AWS Regions, VPCs, services, and remote clients. The key assessment skill is recognizing the required connectivity scope—single VPC, multiple VPCs, multiple Regions, private service exposure, or remote user access—and selecting an architecture that balances scalability, bandwidth, latency, encryption, and operational complexity.

Key Concepts

• AWS managed Site-to-Site VPN: An IPsec VPN connection between a customer network and AWS. The architecture uses a customer gateway on the customer side and a virtual private gateway on the VPC side.
• AWS Transit Gateway: A regional network hub that can connect multiple VPCs and VPN attachments within a Region.
• AWS Direct Connect: A private network connection into AWS that can provide better bandwidth and latency characteristics than an internet-based VPN. A private virtual interface connects the customer network toward a VPC through the connectivity architecture.
• Direct Connect Gateway: Extends Direct Connect connectivity across multiple AWS Regions. Transit gateways can then provide connectivity to multiple VPCs within each Region.
• VPC peering: Private routing between VPCs. It is non-transitive, requires non-overlapping CIDR blocks, and becomes difficult to scale when many VPCs require full-mesh connectivity.
• AWS PrivateLink: Private access to a service in another VPC through private endpoints. The service provider side uses a Network Load Balancer.
• AWS Client VPN: Remote client access to a VPC using a TLS-based VPN.
• Software VPN or software appliance: A third-party virtual appliance, such as one running on EC2, used instead of an AWS-managed VPN service.
• VPN CloudHub: An architectural pattern using multiple managed VPN connections to provide connectivity between multiple customer networks.

Hybrid Connectivity Architectures

AWS Managed Site-to-Site VPN

A basic hybrid design connects one or more customer networks to a VPC using AWS-managed IPsec VPN connectivity. The customer side uses a customer gateway, while the VPC side uses a virtual private gateway. Multiple customer gateways can be used to provide additional redundancy on the customer-network side.

This option is appropriate when encrypted connectivity between an on-premises environment and AWS is needed without using a dedicated private circuit.

Transit Gateway with VPN

A VPN can terminate on a Transit Gateway instead of connecting directly to only one VPC. This allows the VPN-connected customer network to reach multiple VPCs within the Transit Gateway’s Region. Multiple IPsec tunnels and customer gateways can be included when the architecture needs additional connectivity or redundancy.

The important distinction is scope: a virtual private gateway is associated with a VPC, while a Transit Gateway is designed to serve as a regional hub for multiple VPCs and network attachments.

Direct Connect to a VPC

Direct Connect provides a private network connection from the customer network into AWS. The architecture can include customer routers or firewalls, an 802.1Q VLAN, and a private virtual interface used to reach a VPC through a virtual private gateway.

Direct Connect is selected when the requirements emphasize a private connection, improved bandwidth, or lower latency characteristics. Redundancy can be designed with multiple customer firewalls and multiple Direct Connect connections. The virtual private gateway is also described in the lesson as a redundant device.

Direct Connect Gateway with Transit Gateways

A Direct Connect Gateway is used when Direct Connect must reach multiple AWS Regions. Within each Region, a Transit Gateway connects the Direct Connect architecture to multiple VPCs.

This produces a two-level connectivity model:

1. Direct Connect provides the private path from the customer network.
2. Direct Connect Gateway provides connectivity across Regions.
3. Regional Transit Gateways provide connectivity to multiple VPCs in each Region.

Direct Connect with VPN Encryption

Direct Connect can be combined with a VPN when traffic crossing the Direct Connect path must receive IPsec encryption. The VPN runs over the Direct Connect connectivity and provides encryption in transit from the customer network through to the VPC.

The choice reflects a tradeoff: Direct Connect addresses private connectivity, bandwidth, and latency requirements, while the VPN adds IPsec encryption.

Direct Connect, Transit Gateway, and VPN

A more scalable design combines Direct Connect with an IPsec VPN to a Transit Gateway. The Transit Gateway then provides access to multiple VPCs. This retains the private Direct Connect path and VPN encryption while using a regional hub rather than connecting directly to a single VPC.

VPN CloudHub

VPN CloudHub is an architectural pattern rather than a separate AWS networking technology. It consists of multiple managed VPN connections from different customer networks to a virtual private gateway and is used to establish connectivity between those networks.

Software Site-to-Site VPN

A software Site-to-Site VPN uses a third-party software appliance rather than an AWS-managed VPN service. The appliance can run on EC2 and provide VPN connectivity into the AWS environment.

This option is useful when the organization specifically requires a third-party appliance or software-based networking capability, but it introduces responsibility for operating that appliance.

VPC-to-VPC Connectivity and Remote Access

VPC Peering

VPC peering provides private routing between VPCs, but it is non-transitive. If VPC A peers with VPC B and VPC B peers with VPC C, VPC A cannot use VPC B as a transit path to reach VPC C.

Peering also requires that the VPC CIDR blocks do not overlap. For a small number of VPCs, direct peering may be practical. Full-mesh connectivity requires a separate peering connection between each pair of VPCs; for four VPCs, the lesson illustrates six connections. As the number of VPCs grows, routing and connection management become increasingly complex.

Transit Gateway and Transit Gateway Peering

A Transit Gateway connects multiple VPCs within the Region where it is created. To connect Transit Gateways in different Regions, the Transit Gateways can be peered. This supports connectivity across multiple Regions and the VPCs attached to the regional hubs.

Compared with a full mesh of VPC peering connections, this hub-based model is more suitable for larger multi-VPC environments.

VPC-to-VPC VPN Options

VPCs can also communicate through VPN-based designs. A software virtual appliance can provide a software Site-to-Site VPN, including a connection toward a managed VPN in another environment or Region. An AWS-managed VPN can also connect VPCs through a customer firewall and customer network.

These designs may be appropriate when VPN-based encryption or a particular network security appliance is required, but they introduce more routing and appliance considerations than a direct hub-based design.

AWS PrivateLink

PrivateLink connects a consumer VPC to a service in a provider VPC through private endpoints. The provider-side service uses a Network Load Balancer. This is service-oriented connectivity: the consumer accesses the published service rather than receiving broad network-level connectivity to the provider VPC.

PrivateLink is therefore different from VPC peering or Transit Gateway connectivity. It is used to consume a specific service privately, not to create general routing between all networks.

Remote Client Access

For user or client access into a VPC, AWS Client VPN provides a TLS VPN connection from clients. An alternative is a software client VPN based on an organization-owned software appliance, with clients connecting over the internet.

These are remote-access patterns, not replacements for Direct Connect or Site-to-Site VPN architectures connecting entire customer networks.

Exam- or Assessment-Relevant Takeaways

• Choose AWS managed VPN for encrypted Site-to-Site connectivity between a customer network and AWS when a dedicated private connection is not the primary requirement.
• Choose Transit Gateway with VPN when one VPN-connected network must reach multiple VPCs in the same Region.
• Choose Direct Connect when the scenario emphasizes a private connection, better bandwidth, or lower latency characteristics.
• Add a Direct Connect Gateway when Direct Connect must reach VPCs across multiple Regions.
• Use Transit Gateway within each Region to connect the Direct Connect architecture to multiple VPCs.
• Add a VPN over Direct Connect when IPsec encryption in transit is required in addition to private Direct Connect connectivity.
• Treat VPC peering as suitable for smaller environments. Remember that it is non-transitive, requires non-overlapping CIDRs, and becomes operationally complex in a full mesh.
• Use Transit Gateway peering to connect regional Transit Gateways across Regions.
• Use PrivateLink for private, endpoint-based access to a specific service exposed from another VPC through a Network Load Balancer.
• Use Client VPN for remote client access, not for connecting an entire on-premises network as a Site-to-Site architecture.
• Recognize VPN CloudHub as an architecture pattern built from multiple managed VPN connections, not as a standalone connectivity service.

Tool / Feature Decision Guide

Requirement	Strong candidate	Decisive reason
Encrypted customer-network-to-VPC connectivity	AWS managed Site-to-Site VPN	Uses IPsec and connects a customer network to AWS
One VPN connection must reach several VPCs in one Region	Transit Gateway with VPN	Transit Gateway acts as a regional hub
Private customer-to-AWS connection with bandwidth and latency emphasis	Direct Connect	Provides a private network connection
Direct Connect must reach several AWS Regions	Direct Connect Gateway	Extends the Direct Connect architecture across Regions
Multiple VPCs must be connected within each Region	Transit Gateway	Provides regional hub connectivity to multiple VPCs
Direct Connect traffic also needs IPsec encryption	VPN over Direct Connect	Combines Direct Connect private connectivity with VPN encryption
A small number of VPCs need direct private routing	VPC peering	Straightforward private routing when scale is limited
Many VPCs need scalable hub-based connectivity	Transit Gateway	Avoids a large full mesh of peering connections
A consumer needs private access to a specific service	AWS PrivateLink	Uses private endpoints and a provider-side Network Load Balancer
Individual clients need remote VPC access	AWS Client VPN	Provides TLS VPN access for clients
A third-party network appliance is required	Software VPN appliance	Uses customer-selected software rather than an AWS-managed VPN

Common Traps / Misconceptions

• Assuming VPC peering is transitive: Peering connections do not make an intermediate VPC a routing transit point.
• Using peering for a large full mesh: Every VPC pair needs its own peering connection, so both connection count and routing complexity grow quickly.
• Ignoring overlapping CIDRs: VPC peering requires non-overlapping CIDR blocks.
• Confusing Direct Connect Gateway and Transit Gateway: Direct Connect Gateway supports connectivity across Regions, while Transit Gateway connects multiple VPCs within a Region. In a multi-Region design, they can be used together.
• Assuming Direct Connect automatically provides VPN encryption: If IPsec encryption is required over the Direct Connect path, the design must include a VPN.
• Treating PrivateLink as general VPC routing: PrivateLink provides private access to a published service, not unrestricted network connectivity between the VPCs.
• Calling VPN CloudHub a distinct networking service: It is an architectural pattern based on multiple managed VPN connections.
• Confusing Client VPN with Site-to-Site VPN: Client VPN serves remote clients, whereas Site-to-Site VPN connects networks.
• Assuming AWS-managed VPN is the only VPN model: A software Site-to-Site VPN can use a third-party appliance running on EC2.

Real-World Engineer / Analyst Notes

• Start with the traffic scope: client-to-VPC, customer-network-to-VPC, VPC-to-VPC, or service-to-VPC. This usually eliminates several options immediately.
• Separate path characteristics from routing scale. Direct Connect addresses the private transport requirement, while Transit Gateway addresses multi-VPC routing within a Region.
• In a multi-Region architecture, explicitly identify both layers: Direct Connect Gateway for regional reach and Transit Gateway for VPC aggregation within each Region.
• Redundancy is a design concern at multiple points, including customer gateways, customer firewalls, and Direct Connect connections. Do not assume that one connection represents a resilient architecture.
• Before recommending VPC peering, inventory CIDR ranges and estimate the number of required pairwise connections. A design that works for three VPCs may become difficult to operate as the environment grows.
• Use PrivateLink when the goal is controlled service consumption rather than broad network trust or full routing between environments.
• When evaluating a VPN-over-Direct-Connect design, verify that the requirement is truly encryption in transit; Direct Connect and VPN solve different architectural concerns.

Quick Reference Summary

• AWS managed VPN: IPsec Site-to-Site connection using a customer gateway and virtual private gateway.
• Transit Gateway: Regional hub for multiple VPCs and VPN connections.
• Direct Connect: Private connectivity with bandwidth and latency advantages.
• Direct Connect Gateway: Multi-Region extension for Direct Connect.
• VPC peering: Private, non-transitive, CIDR-non-overlapping connectivity that fits smaller environments.
• Transit Gateway peering: Connects Transit Gateways across Regions.
• PrivateLink: Private endpoint access to a specific service exposed through a Network Load Balancer.
• Client VPN: TLS-based remote client access to a VPC.
• VPN CloudHub: Multiple managed VPNs used as an architecture for connecting customer networks.
• Software VPN: Third-party virtual appliance-based VPN connectivity.

Flashcards

Q: A customer network needs encrypted connectivity to one VPC, and dedicated private connectivity is not the primary requirement. Which architecture is the natural starting point?

A: Use an AWS managed Site-to-Site VPN with a customer gateway and a virtual private gateway. It provides IPsec connectivity between the customer network and VPC.

Q: When should a VPN terminate on a Transit Gateway instead of directly on a virtual private gateway?

A: Use a Transit Gateway when the VPN-connected network needs to reach multiple VPCs within the same Region. It provides a regional hub rather than a connection limited to one VPC.

Q: A company requires a private AWS connection with better bandwidth and latency characteristics. Which option should be evaluated first?

A: Direct Connect should be evaluated first because it provides a private network connection into AWS. Redundant customer devices and multiple Direct Connect connections may also be designed.

Q: What problem does a Direct Connect Gateway solve in a multi-Region architecture?

A: It allows Direct Connect connectivity to extend across multiple AWS Regions. Transit Gateways can then connect to the multiple VPCs within each Region.

Q: Why combine a VPN with Direct Connect?

A: The combination is used when the private Direct Connect path is desired but IPsec encryption in transit is also required. Direct Connect and VPN address different requirements.

Q: What is the key scalability limitation of VPC peering?

A: VPC peering is non-transitive, so full connectivity requires a separate peering relationship between each VPC pair. The resulting connection and routing complexity grows as the number of VPCs increases.

Q: What CIDR condition must be satisfied before establishing VPC peering?

A: The VPC CIDR blocks must not overlap. Overlapping CIDRs prevent the required private routing relationship.

Q: Four VPCs require full-mesh VPC peering. How many pairwise peering connections are illustrated by the lesson?

A: Six connections. Full mesh requires one connection for every pair of VPCs.

Q: How does Transit Gateway peering support multi-Region VPC connectivity?

A: Each regional Transit Gateway connects its local VPCs, and Transit Gateway peering connects the regional hubs across Regions.

Q: A consumer VPC needs private access to an application service in another VPC, but not general routing to that VPC. Which feature fits best?

A: AWS PrivateLink fits best. It uses private endpoints for service access, with a Network Load Balancer on the service-provider side.

Q: What is the difference between Client VPN and Site-to-Site VPN in terms of connection scope?

A: Client VPN provides remote access for individual clients using TLS VPN, while Site-to-Site VPN connects networks such as an on-premises customer network and AWS.

Q: What makes VPN CloudHub different from AWS managed VPN?

A: VPN CloudHub is an architectural pattern consisting of multiple managed VPN connections that provide connectivity between customer networks. It is not a separate standalone technology.

Q: When would a software Site-to-Site VPN be selected instead of an AWS-managed VPN?

A: Select it when a third-party software appliance is required or preferred. The appliance can run on EC2, but the organization must operate that software-based component.

Q: What is the trap when selecting PrivateLink for VPC connectivity?

A: PrivateLink is not general-purpose VPC routing. It provides private access to a specific published service, rather than broad network connectivity between the participating VPCs.

Practice Questions

Question 1

An organization has one on-premises network and six VPCs in the same AWS Region. It wants the on-premises network to access all VPCs without creating a separate direct connection to each VPC. Which architecture is the best fit?

A. VPC peering between the on-premises network and each VPC
B. AWS managed VPN attached to a Transit Gateway
C. AWS PrivateLink between the on-premises network and each VPC service
D. Client VPN for the on-premises routers

Correct answer: B. A Transit Gateway provides a regional hub for multiple VPCs, and the managed VPN supplies encrypted connectivity from the customer network.

Question 2

A company requires a private connection from its data center to VPCs in several AWS Regions. Within each Region, it has multiple VPCs that must be reachable. Which combination directly addresses both requirements?

A. VPC peering plus Client VPN
B. AWS managed VPN plus VPC peering
C. Direct Connect Gateway plus regional Transit Gateways
D. PrivateLink plus a virtual private gateway

Correct answer: C. Direct Connect Gateway provides the multi-Region Direct Connect architecture, while Transit Gateways connect multiple VPCs within each Region.

Question 3

Three VPCs need private routing, their CIDR blocks do not overlap, and the environment is expected to remain small. There is no requirement for a central routing hub. Which option is reasonable?

A. VPC peering
B. Direct Connect Gateway
C. Client VPN
D. PrivateLink only

Correct answer: A. VPC peering is workable for smaller environments with non-overlapping CIDRs, although it is non-transitive and does not scale well as the environment grows.

Question 4

A service provider wants customers in other VPCs to consume one application privately. Customers should not receive broad routed access to the provider VPC. Which feature should be selected?

A. Transit Gateway peering
B. VPC peering
C. AWS PrivateLink
D. VPN CloudHub

Correct answer: C. PrivateLink is designed for private endpoint-based access to a specific service, with a Network Load Balancer used on the provider side.

Question 5

A design uses Direct Connect for private connectivity, but the security requirement specifically calls for IPsec encryption from the customer network to the VPC. What should the engineer add?

A. VPC peering
B. A VPN over the Direct Connect connection
C. Client VPN only
D. Transit Gateway peering without a VPN

Correct answer: B. The lesson identifies VPN over Direct Connect as the combination that adds IPsec encryption to the private Direct Connect path.

WordPress Metadata

Suggested Slug:
aws-vpc-connectivity-options

Meta Description:
Study the AWS VPC connectivity architectures used for hybrid networking, multi-VPC communication, cross-region routing, private service access, and remote client access.

Tags:
AWS, Amazon VPC, AWS VPN, AWS Direct Connect, AWS Transit Gateway, VPC Peering, AWS PrivateLink, Client VPN, Hybrid Networking, Network Architecture