Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS Direct Connect (DX) provides dedicated, private network connectivity between an on-premises data center or office and AWS. For the SAP-C02 exam, the important design questions are usually about selecting DX versus VPN, designing resilient connectivity, choosing the correct virtual interface, understanding encryption boundaries, and applying BGP routing behavior.
Direct Connect is not simply an AWS-managed cable from a data center to a VPC. The customer is responsible for the customer-side router, the connection from the data center to the DX location, and often the colocation or connectivity provider. AWS provides the DX infrastructure from the Direct Connect location onward.
Key Concepts
Direct Connect physical architecture
A typical dedicated DX design contains:
- A customer or partner router in a corporate data center or colocation facility.
- A private connection from the data center to an AWS Direct Connect location.
- A customer or partner cage at that location.
- A cross-connect to AWS equipment in the AWS cage.
- A Direct Connect port and one or more virtual interfaces.
The customer must arrange the physical connectivity into the DX location, either directly or through an AWS Direct Connect partner. AWS operates the AWS-side infrastructure.
DX uses dedicated fiber connections with bandwidth options that vary by location, port type, and AWS availability. Available speeds change over time, so verify current options in the AWS documentation when making a production decision.
Why use Direct Connect?
Direct Connect can provide:
- Private connectivity that does not traverse the public internet.
- More consistent latency and throughput than internet-based VPN connectivity.
- Higher bandwidth for sustained hybrid traffic.
- Potentially lower data-transfer costs for large and predictable traffic volumes, depending on AWS, provider, and data-transfer charges.
- A stable path for hybrid applications, migrations, replication, and large-scale data processing.
DX is not automatically the least expensive option. The analysis must include port charges, cross-connect or colocation charges, partner fees, data-transfer charges, operational costs, and the cost of redundant connections.
Direct Connect virtual interfaces
A virtual interface (VIF) is a logical connection configured over a DX connection. VIFs use VLAN tagging and BGP to exchange routes.
| VIF type | Primary use | Important details |
|---|---|---|
| Private VIF | Connectivity to a VPC using private IP addresses | Traditionally connects to a virtual private gateway (VGW); a private VIF can also be associated through a Direct Connect gateway for supported multi-Region or multi-VPC designs. |
| Public VIF | Connectivity to AWS public service endpoints | Can reach supported AWS public services in any Region, such as Amazon S3 and Amazon DynamoDB. It does not provide general internet access. |
| Transit VIF | Connectivity to one or more transit gateways | Used with a Direct Connect gateway and AWS Transit Gateway for centralized connectivity to multiple VPCs and networks. |
A private VIF is not the same thing as a public VIF. A public VIF provides access to AWS public service prefixes; it is not an internet transit path.
Multiple private VIFs can be used for multiple VPC connections where the selected architecture supports them. Direct Connect gateway and Transit Gateway designs are generally more scalable than building a separate VIF and VGW relationship for every VPC.
Hosted VIFs and hosted connections
AWS Direct Connect partners can provide shared connectivity:
- A hosted VIF is a virtual interface provisioned by a partner and shared over partner infrastructure. Bandwidth is shared according to the provider’s offering.
- A hosted connection is a partner-provided DX connection with a VIF dedicated to the customer, although the underlying partner infrastructure is still managed by the partner.
The exact bandwidth limits and supported features depend on the partner and AWS’s current service model. Confirm current limits before selecting a partner architecture.
Link aggregation groups
A Link Aggregation Group (LAG) combines multiple DX connections into one logical connection using LACP. This can increase aggregate bandwidth and simplify management, but it does not automatically provide complete geographic or facility independence.
If all member links share the same DX location, provider, building, or physical pathway, a common failure can still affect the entire LAG. LAG suitability also depends on the connection speeds and AWS requirements in the selected location.
Direct Connect resiliency
A single DX connection can fail because of many components, including:
- The customer router or switch.
- The provider or partner router.
- The cross-connect.
- The DX port or AWS-side equipment.
- The DX location.
- The corporate data center.
- Shared cable routes or common power and facility dependencies.
Redundancy should be designed according to the required failure domain, not merely by counting connections.
| Design | Strengths | Remaining concerns |
|---|---|---|
| One DX connection | Lowest cost and simplest deployment | Many single points of failure |
| Redundant equipment or links in one DX location | Protects against some device or link failures | Does not protect against DX-location, facility, or shared-pathway failure |
| DX connections from multiple DX locations and data centers | Strongest physical and facility diversity | Highest cost and operational complexity |
| DX primary with Site-to-Site VPN backup | Cost-effective backup and simpler than a second DX location | Internet-dependent backup has lower or less predictable bandwidth and latency |
For critical workloads, use diverse DX locations, data centers, routers, providers, and physical paths where practical. A second connection in the same facility may not satisfy a requirement for regional or site-level resiliency.
VPN backup for Direct Connect
A Site-to-Site VPN can provide a lower-cost backup path over the internet. In the common VGW-based design:
- The DX and VPN connections terminate against the same virtual private gateway.
- The same VPC prefixes are advertised through both paths.
- DX is normally preferred over the VPN based on route-selection behavior.
- The VPN provides continuity if DX fails, but its bandwidth, latency, and reliability may not satisfy high-throughput requirements.
This pattern is generally more appropriate when the backup path does not need to support very high throughput. The source material identifies limitations for designs above 1 Gbps; validate current AWS VPN capabilities and the workload’s actual failover requirements before relying on this pattern.
DX encryption options
Direct Connect is not encrypted by default. Two common approaches provide encryption:
#### MACsec
MACsec is the IEEE 802.1AE Layer 2 security standard. On supported DX ports and equipment, it provides encryption and integrity protection over the link between the customer router or switch and the AWS DX device.
Important boundaries:
- It protects the customer-to-AWS-cage link.
- It does not provide end-to-end encryption through the AWS network to a VPC endpoint or workload.
- It uses AES-GCM and is designed for near-line-rate performance.
- It requires compatible customer equipment, port support, and AWS configuration.
MACsec is suitable when the requirement is encryption on the physical DX connection with minimal throughput impact.
#### IPsec VPN over a public VIF
An IPsec Site-to-Site VPN can be established over the DX connection using a public VIF. This is a frequent exam distinction: the traffic uses DX for transport, but the VPN terminates at a VGW and encrypts traffic at the IP layer.
This provides encryption from the on-premises VPN endpoint to the VGW. It does not encrypt traffic beyond the VPN termination point to the individual application endpoint.
| Requirement | Suitable approach |
|---|---|
| Private, predictable connectivity without encryption | Direct Connect |
| Encryption on the customer-to-DX-device link | MACsec, if supported |
| IP-layer encryption to a VPC gateway | IPsec VPN over a public VIF |
| Encrypted traffic all the way to an application endpoint | Use an appropriate application or host-level encryption design; DX or MACsec alone is insufficient |
Customer router and BGP requirements
The customer router generally needs to support:
- Single-mode fiber and the correct optical transceiver.
- 802.1Q VLAN tagging.
- BGP, including BGP MD5 authentication.
- An autonomous system number (ASN).
- Optional Bidirectional Forwarding Detection (BFD), which is recommended for faster failure detection.
A private ASN must be within the AWS-supported private ASN range, commonly 64512–65535; confirm current AWS requirements for the selected interface and design. For a public VIF, the organization must own and advertise the public IP prefixes it uses.
The optical module must match the port speed and fiber requirements. Examples include 1000BASE-LX for 1 Gbps and 10GBASE-LR for 10 Gbps. Higher-speed interfaces use their corresponding supported optics. Auto-negotiation may need to be disabled for connections above 1 Gbps.
BFD and failure detection
BGP convergence can be slow if it waits for hold timers to expire. BFD provides faster forwarding-path failure detection and can trigger faster routing convergence.
AWS enables asynchronous BFD on the AWS side of a DX virtual interface. BFD must also be configured on the customer router. The default AWS-side liveness settings described in the lesson include a 300-millisecond minimum interval and a multiplier of 3; these values and supported configuration options should be verified against current AWS documentation.
DX route preference with a VPN backup
When the same prefixes are available through DX and a Site-to-Site VPN using a VGW, the relevant preference order is generally:
- BGP-propagated routes from Direct Connect.
- Manually configured static VPN routes.
- BGP-propagated routes from a Site-to-Site VPN.
If multiple VPN BGP paths remain candidates, AWS can compare attributes such as AS-path length and MED. A shorter AS path is preferred; when applicable, the lower MED is preferred.
Do not rely only on route preference for failover. Validate route advertisements, return paths, BGP timers, BFD behavior, and the actual convergence time in a test environment.
Exam-Relevant Takeaways
- Direct Connect is a dedicated private connection, but the customer is responsible for the customer router and connectivity into the DX location.
- A public VIF provides access to AWS public services, not general internet access.
- A private VIF is used for private VPC connectivity; a transit VIF is used with a Direct Connect gateway and Transit Gateway.
- DX is not encrypted by default.
- MACsec encrypts the Layer 2 link up to the AWS DX device, not end to end to the workload.
- IPsec VPN over a public VIF encrypts traffic to a VGW and is a common way to add IP-layer encryption over DX.
- A VPN backup is cheaper than a second DX location but has lower bandwidth and less predictable internet-path performance.
- Redundant links in one DX location do not protect against failure of that location or shared physical paths.
- BGP is required for route exchange, and BFD can improve failure detection and convergence.
- Hosted VIFs and hosted connections involve AWS Direct Connect partners and have provider-dependent bandwidth and operational characteristics.
- Always evaluate total cost, including partner, colocation, port, data-transfer, and redundancy costs.
Architecture Decision Guide
| Scenario | Recommended design | Reasoning |
|---|---|---|
| Occasional, low-volume hybrid access | Site-to-Site VPN | Lower setup cost and simpler deployment may outweigh DX benefits. |
| High-volume, predictable hybrid traffic | Direct Connect | More consistent performance and potentially better economics at scale. |
| Mission-critical hybrid connectivity | Diverse DX connections and locations | Reduces dependence on a single router, link, facility, or DX location. |
| Critical primary DX with a budget-conscious backup | DX plus Site-to-Site VPN | Provides a lower-cost secondary path with reduced performance. |
| Multiple VPCs requiring centralized connectivity | Transit VIF with Direct Connect gateway and Transit Gateway | Centralizes routing and scales better than many isolated connections. |
| Access to Amazon S3 through private connectivity | Public VIF or an appropriate private VPC endpoint design | Public VIF reaches AWS public service prefixes; it is not internet access. |
| Encryption on the physical DX link | MACsec | Protects the customer-to-DX-device Layer 2 segment where supported. |
| Encryption to a VPC gateway | IPsec VPN over a public VIF | Provides encrypted IP traffic to the VGW. |
Common Exam Traps
- “Direct Connect is encrypted by default.” It is not. Select MACsec or IPsec when encryption is required.
- “A public VIF provides internet access.” A public VIF provides access to AWS public service endpoints and AWS public prefixes, not arbitrary internet destinations.
- “Two DX links in one location eliminate all single points of failure.” They may still share a facility, provider, router, power source, or cable path.
- “MACsec encrypts traffic end to end.” MACsec protects only the supported Layer 2 segment up to the AWS DX device.
- “IPsec over DX uses a private VIF.” The described VPN-over-DX pattern uses a public VIF and terminates at a VGW.
- “A VPN backup has the same performance as DX.” Internet-based VPN performance is generally less predictable and may have substantially lower bandwidth.
- “A Direct Connect gateway is the same as a virtual private gateway.” A VGW terminates connectivity for a VPC; a Direct Connect gateway is used to associate DX connectivity with supported VPC or Transit Gateway architectures.
- “A LAG guarantees geographic redundancy.” LACP aggregates links but does not create diversity if all links share the same failure domain.
- “BGP will fail over immediately.” Without suitable timers or BFD, convergence can take significant time.
Real-World Engineer Notes
- Select DX locations based on physical diversity, provider availability, latency, construction routes, and operational access—not only geographic distance.
- Document every failure domain: customer router, cross-connect, carrier, building, power, fiber route, DX location, and AWS Region.
- Test failover while measuring application impact, BGP convergence, asymmetric routing, and the capacity available on the backup path.
- Confirm that the VPN backup can handle essential traffic, including identity services, DNS, monitoring, replication, and management—not just application traffic.
- Use route filtering and explicit prefix advertisements. Avoid accidentally advertising overly broad routes from either on-premises or AWS.
- Treat BGP authentication, router ACLs, VLAN configuration, MTU behavior, and monitoring as production requirements.
- Recheck current DX port speeds, MACsec support, partner limits, supported Regions, and transceiver requirements before implementation.
- Calculate total cost over the expected traffic profile. A dedicated link can be financially attractive for sustained high-volume transfer but unnecessary for intermittent workloads.
Quick Reference Summary
- DX purpose: Dedicated private connectivity between on-premises networks and AWS.
- Customer responsibilities: Customer router, data-center-to-DX-location connectivity, and often provider or colocation arrangements.
- Private VIF: Private connectivity to VPC resources.
- Public VIF: AWS public service endpoints; not general internet transit.
- Transit VIF: Transit Gateway connectivity through a Direct Connect gateway.
- Encryption: Not enabled by default.
- MACsec: Layer 2 encryption to the AWS DX device.
- IPsec over DX: VPN over a public VIF to a VGW.
- Resiliency: Use diverse links, routers, facilities, providers, and DX locations as required.
- Routing: BGP is required; BFD improves failure detection.
- Backup: Site-to-Site VPN is lower cost but usually lower performance than DX.
Flashcards
- Q: What problem does AWS Direct Connect solve?
A: It provides dedicated private network connectivity between an on-premises network and AWS.
- Q: Is Direct Connect encrypted by default?
A: No. Encryption requires MACsec, IPsec, or another encryption layer.
- Q: What is a private VIF used for?
A: Connecting to VPC resources using private IP addressing.
- Q: What is a public VIF used for?
A: Reaching AWS public service endpoints and AWS public prefixes; it is not general internet access.
- Q: What is a transit VIF used for?
A: Connecting DX to one or more Transit Gateways through a Direct Connect gateway.
- Q: What does MACsec protect?
A: The Layer 2 link between the customer router or switch and the AWS DX device.
- Q: How can IPsec encryption be added over DX?
A: Establish a Site-to-Site VPN over a public VIF, terminating at a VGW.
- Q: Why are two DX links in one location not always sufficient for high availability?
A: They may share the same facility, provider, power, router, or physical cable path.
- Q: What protocol exchanges routes over a DX VIF?
A: BGP.
- Q: What does BFD provide?
A: Faster detection of forwarding-path failures and potentially faster routing convergence.
- Q: What is a hosted VIF?
A: A partner-provided virtual interface using shared partner infrastructure and bandwidth.
- Q: What is the normal purpose of a VPN alongside DX?
A: To provide a lower-cost backup path if the primary DX connection fails.
Practice Questions
Question 1
A company requires private connectivity from its data center to Amazon S3 and DynamoDB in multiple AWS Regions. It does not want to provide general internet access through the connection. Which design best meets the requirement?
A. Use a private VIF attached to a single VGW in one VPC.
B. Use a public VIF and advertise a default route to the data center.
C. Use a public VIF to access AWS public service prefixes.
D. Use a Site-to-Site VPN over the internet only.
Correct answer: C
Explanation: A public VIF provides access to supported AWS public service endpoints across Regions without acting as general internet transit. A private VIF is intended for private VPC connectivity.
Question 2
A regulated workload uses Direct Connect and requires encryption on the dedicated physical connection with minimal throughput overhead. The customer router and the selected DX port support the feature. Which option should the architect recommend?
A. MACsec on the DX connection
B. A public VIF without additional encryption
C. A private VIF with no encryption
D. An internet gateway attached to the VPC
Correct answer: A
Explanation: MACsec provides Layer 2 encryption and integrity protection over the supported customer-to-DX-device link with near-line-rate performance. Direct Connect itself is not encrypted by default.
Question 3
A company has one DX connection and wants an inexpensive backup. The backup must use the same VPC and should be selected only when DX is unavailable. Which design is most appropriate?
A. A second public VIF in the same DX connection
B. A Site-to-Site VPN using the same VGW, advertising the same prefixes
C. An internet gateway with a NAT gateway
D. A second hosted VIF from the same partner, with no VPN
Correct answer: B
Explanation: A Site-to-Site VPN connected to the same VGW can provide a backup path. With matching prefixes, DX is generally preferred over the VPN according to route-selection behavior. The VPN’s capacity and latency must still be validated.
Question 4
A financial-services organization requires connectivity that can survive the loss of an entire DX facility. Which architecture provides the strongest resilience?
A. Two LACP member links in one DX location
B. Two customer routers connected to the same cross-connect
C. Diverse DX connections from separate data centers and DX locations
D. One DX connection with a larger port speed
Correct answer: C
Explanation: Separate data centers and DX locations reduce common facility and physical-path failure domains. LAG and additional equipment in one location do not protect against loss of that entire location.
Question 5
An enterprise plans to connect many VPCs and Transit Gateways to on-premises networks through Direct Connect. Which interface type is designed for Transit Gateway connectivity?
A. Public VIF
B. Private VIF only
C. Transit VIF associated with a Direct Connect gateway
D. Loopback interface
Correct answer: C
Explanation: A transit VIF is used with a Direct Connect gateway to provide connectivity to one or more Transit Gateways, supporting centralized hybrid routing at scale.