AWS Direct Connect Gateway for Multi-Region Hybrid Connectivity – SAP-C02 Study Guide

Purpose of This Lesson

AWS Direct Connect Gateway is used to connect on-premises environments to VPCs across multiple AWS Regions using AWS Direct Connect. For the SAP-C02 exam, this topic matters because many hybrid networking scenarios require private, resilient, multi-region connectivity between corporate data centers and AWS workloads.

A key exam point is that Direct Connect itself is regional, but Direct Connect Gateway is a global resource. This allows a single Direct Connect connection in one geography to reach VPCs in multiple AWS Regions without requiring separate long-distance private circuits to every regional Direct Connect location.

Key Concepts

What Is AWS Direct Connect Gateway?

AWS Direct Connect Gateway is a globally available AWS networking resource that allows you to connect AWS Direct Connect private connectivity to VPCs across multiple AWS Regions.

You can create a Direct Connect Gateway in any AWS Region, but the resource itself can be used globally. Once created, it can be associated with supported AWS gateway types in different Regions.

Direct Connect Gateway is commonly used when an organization has:

• A corporate data center
• An AWS Direct Connect connection at one Direct Connect location
• VPCs in multiple AWS Regions
• A requirement for private connectivity from on-premises to those VPCs

Direct Connect Gateway helps avoid the need to build separate private network circuits from the corporate data center to Direct Connect locations in each region of the world.

Direct Connect Without Direct Connect Gateway

Without Direct Connect Gateway, a private virtual interface, or private VIF, connects a Direct Connect connection to a virtual private gateway attached to a single VPC in the same AWS Region.

For example:

• A data center in the United States connects to a US Direct Connect location.
• A private VIF connects that Direct Connect connection to a VPC in us-west-1.
• If the same company also wants to connect privately to a VPC in eu-central-1, it may need connectivity into a European Direct Connect location.

This can create a major design problem. If the corporate data center is physically located near a US Direct Connect location, the private circuit to that location may be reasonable. But extending a private WAN circuit from that same US data center to a European Direct Connect location could be expensive, complex, and operationally inefficient.

Direct Connect Gateway solves this by allowing the Direct Connect connection to reach VPCs in different AWS Regions through a global gateway model.

Direct Connect Gateway Architecture

With Direct Connect Gateway, the on-premises environment connects to an AWS Direct Connect location using a Direct Connect connection. A private VIF is then associated with the Direct Connect Gateway instead of being tied directly to a single regional virtual private gateway.

The Direct Connect Gateway can then be associated with:

• A virtual private gateway attached to a VPC
• A transit gateway, typically when connecting to multiple VPCs in the same Region

In the transcript’s example, a corporate data center connects to a US Direct Connect location. Instead of building a second private link to Europe, the Direct Connect Gateway is associated with virtual private gateways in multiple AWS Regions, such as:

• us-west-1
• eu-central-1

This allows the on-premises network to reach VPCs in both Regions using private connectivity over Direct Connect.

Direct Connect Gateway Is Global, But Direct Connect Is Regional

This distinction is very important for the SAP-C02 exam.

AWS Direct Connect connections are associated with Direct Connect locations, which are tied to specific geographic areas. A private VIF traditionally connects to a VPC through a virtual private gateway in a specific Region.

Direct Connect Gateway changes the architecture by acting as a global intermediary. It lets you use one Direct Connect location to connect to VPCs in multiple AWS Regions.

However, this does not mean Direct Connect Gateway creates a fully meshed AWS network. It is primarily for routing between on-premises and AWS VPCs, not for routing directly between VPCs.

Private VIFs and Direct Connect Gateway

A private virtual interface is used to connect private Direct Connect connectivity into AWS.

When using Direct Connect Gateway:

• The private VIF is associated with the Direct Connect Gateway.
• The Direct Connect Gateway is associated with one or more supported AWS gateways.
• BGP is used to exchange routes between the on-premises router and AWS.
• Routes to associated VPCs are advertised through the Direct Connect Gateway.

You can attach multiple private VIFs to a Direct Connect Gateway. This can be useful for redundancy, multiple Direct Connect connections, or more complex hybrid networking designs.

However, a private VIF cannot be attached to more than one Direct Connect Gateway.

Supported Gateway Associations

A Direct Connect Gateway can be associated with either of the following:

Virtual Private Gateway

A virtual private gateway, or VGW, is attached to a single VPC. This is useful when you want to connect on-premises to one or more VPCs across different AWS Regions using private connectivity.

This is a good fit when the architecture is relatively simple and each VPC has its own VGW.

Transit Gateway

A transit gateway is used when you have multiple VPCs, especially within the same AWS Region, and need centralized routing.

For larger environments, the Direct Connect Gateway can be associated with a transit gateway. The transit gateway can then route traffic to multiple VPC attachments.

This design is more scalable than connecting separately to many individual virtual private gateways.

Routing Behavior with Direct Connect Gateway

Direct Connect Gateway uses BGP to advertise routes between on-premises and AWS.

In a typical design:

• On-premises advertises corporate network prefixes to AWS.
• AWS advertises VPC CIDR blocks to the on-premises network.
• Traffic can route from the data center to the associated VPCs.
• Traffic can route from associated VPCs back to the on-premises network.

The important limitation is that Direct Connect Gateway does not allow the associated VPCs to route directly to each other through the Direct Connect Gateway.

For example, if VPC A in us-west-1 and VPC B in eu-central-1 are both associated with the same Direct Connect Gateway through virtual private gateways, the Direct Connect Gateway does not provide direct VPC-to-VPC communication.

For inter-VPC routing, use Transit Gateway, VPC peering, or another supported AWS networking design depending on the scenario.

Non-Overlapping CIDR Blocks Are Required

VPCs associated with a Direct Connect Gateway must not have overlapping CIDR blocks.

This is a common hybrid networking requirement. Overlapping address ranges create ambiguous routing and are not supported in this design.

For the exam, watch for scenarios where multiple VPCs or on-premises networks use the same CIDR ranges. If CIDRs overlap, Direct Connect Gateway is not a valid solution unless the addressing is redesigned or another pattern is introduced.

Unsupported Traffic Flows

Direct Connect Gateway is not a transit router for every possible traffic path.

The following traffic flows are not supported:

• Direct communication between VPCs associated with the same Direct Connect Gateway
• Direct communication between virtual interfaces attached to the same Direct Connect Gateway
• Direct communication between VIFs attached to the same Direct Connect Gateway and a VPN connection on a virtual private gateway associated with that same Direct Connect Gateway

This means Direct Connect Gateway is best understood as a way to connect on-premises networks to VPCs across Regions, not as a general-purpose hub for all network traffic.

Public VIFs Are Not Used with Direct Connect Gateway

You cannot create a public VIF to a Direct Connect Gateway.

Direct Connect Gateway is used with private VIFs for private connectivity to VPCs, or with transit virtual interfaces when integrating with Transit Gateway architectures.

Public VIFs are used for accessing public AWS services over Direct Connect, not for associating with Direct Connect Gateway in this VPC connectivity model.

One-to-One Attachment Restrictions

There are two important attachment restrictions to remember:

• A virtual private gateway cannot be associated with more than one Direct Connect Gateway.
• A private VIF cannot be attached to more than one Direct Connect Gateway.

These restrictions matter in exam questions where an answer choice suggests sharing the same VGW or private VIF across multiple Direct Connect Gateways. That is not supported.

Exam-Relevant Takeaways

For the SAP-C02 exam, remember that AWS Direct Connect Gateway is used for private, multi-region hybrid connectivity between on-premises networks and AWS VPCs.

The biggest exam theme is choosing Direct Connect Gateway when the customer has a single Direct Connect connection but needs private access to VPCs in multiple AWS Regions.

Direct Connect Gateway is a global resource, while Direct Connect connections are tied to Direct Connect locations. This allows a company to avoid building expensive private circuits to Direct Connect locations in every geography where it has AWS workloads.

Direct Connect Gateway does not provide full mesh routing between VPCs. If the question requires VPC-to-VPC communication, especially at scale, Transit Gateway is usually the better answer.

Private VIFs are associated with Direct Connect Gateway. Direct Connect Gateway can then be associated with virtual private gateways or transit gateways, depending on the architecture.

CIDR blocks must not overlap. Overlapping networks are a common reason an answer choice is invalid.

Architecture Decision Guide

Scenario	Best AWS Choice	Why
On-premises data center needs private connectivity to VPCs in multiple AWS Regions	Direct Connect Gateway	Direct Connect Gateway is global and can connect a Direct Connect connection to VPCs across Regions.
On-premises data center needs private access to a single VPC in one Region	Direct Connect private VIF to VGW	A simple private VIF to a virtual private gateway may be enough if only one regional VPC is involved.
Multiple VPCs in the same Region need centralized routing from on-premises	Direct Connect Gateway with Transit Gateway	Transit Gateway provides scalable hub-and-spoke routing to multiple VPCs.
VPCs associated with the same Direct Connect Gateway need to communicate with each other	Transit Gateway, VPC peering, or another inter-VPC routing design	Direct Connect Gateway does not support direct VPC-to-VPC communication.
Need to access public AWS services over Direct Connect	Public VIF	Public VIFs are used for public AWS service endpoints, not Direct Connect Gateway associations for VPC connectivity.
VPC CIDR blocks overlap	Redesign IP addressing or use another specialized pattern	Direct Connect Gateway requires non-overlapping CIDR blocks.
Need a fully meshed network between multiple VPCs and on-premises	Transit Gateway-based architecture	Direct Connect Gateway alone is not a full transit routing service.
Need to avoid long-distance private circuits to multiple global DX locations	Direct Connect Gateway	A single Direct Connect location can provide access to VPCs in multiple Regions through the global Direct Connect Gateway.

Common Exam Traps

Trap 1: Thinking Direct Connect Gateway Enables VPC-to-VPC Routing

Direct Connect Gateway allows on-premises networks to reach multiple VPCs, but it does not allow those VPCs to communicate directly with each other through the Direct Connect Gateway.

If the question requires inter-VPC communication, look for Transit Gateway, VPC peering, or another supported routing design.

Trap 2: Confusing Direct Connect Gateway with Transit Gateway

Direct Connect Gateway and Transit Gateway are different services.

Direct Connect Gateway is used to connect Direct Connect private connectivity to VPCs or transit gateways, including across Regions.

Transit Gateway is a regional network hub used to connect VPCs, VPNs, and Direct Connect architectures at scale.

In larger environments, they are often used together.

Trap 3: Assuming Direct Connect Is Global

Direct Connect Gateway is global. Direct Connect connections and Direct Connect locations are not global in the same way.

Direct Connect connections terminate at specific Direct Connect locations. Direct Connect Gateway extends the usefulness of that connection across Regions.

Trap 4: Choosing Public VIF for VPC Connectivity Through Direct Connect Gateway

A public VIF is not used to connect to a Direct Connect Gateway for private VPC connectivity.

For VPC access through Direct Connect Gateway, think private VIF.

Trap 5: Ignoring Overlapping CIDRs

Overlapping CIDR blocks are not supported. If two VPCs or an on-premises network share overlapping address ranges, routing through Direct Connect Gateway will not work as a clean design.

Trap 6: Assuming a VGW Can Attach to Multiple Direct Connect Gateways

A virtual private gateway cannot be associated with more than one Direct Connect Gateway.

If an answer choice relies on attaching the same VGW to multiple Direct Connect Gateways, it is not valid.

Trap 7: Assuming a Private VIF Can Attach to Multiple Direct Connect Gateways

A private VIF cannot be attached to more than one Direct Connect Gateway.

For redundancy or scale, use supported designs with multiple VIFs, multiple Direct Connect connections, or Transit Gateway-based architecture.

Real-World Engineer Notes

In real environments, Direct Connect Gateway is most useful when an organization has a central data center or colocation presence and workloads spread across multiple AWS Regions.

From an infrastructure engineering perspective, the main value is avoiding unnecessary private WAN circuits. Instead of buying or managing expensive long-distance links to multiple Direct Connect locations, the organization can connect near its physical data center and use Direct Connect Gateway to reach VPCs in other Regions.

That said, engineers must be careful with route design. Direct Connect Gateway does not replace a complete routing architecture. If VPCs need to talk to each other, or if there are many VPCs per Region, Transit Gateway is usually needed.

Operationally, you should pay attention to:

• BGP route advertisements
• Allowed prefixes
• VPC CIDR planning
• Route table propagation
• Redundant Direct Connect connections
• Redundant customer routers
• Failover testing
• Integration with Site-to-Site VPN backup paths
• Monitoring Direct Connect status and BGP sessions

CIDR planning is one of the biggest real-world concerns. If teams independently create VPCs with overlapping address ranges, Direct Connect Gateway designs can become blocked or require painful readdressing later.

Security teams also need to understand that Direct Connect is private connectivity, but it is not automatically encrypted at the IP layer. If encryption is required, additional design choices may be needed, such as VPN over Direct Connect or application-layer encryption.

From a governance perspective, Direct Connect Gateway should be treated as a central networking resource. Changes to associations, route advertisements, and allowed prefixes can affect multiple Regions and multiple business applications.

Quick Reference Summary

AWS Direct Connect Gateway is a global resource used to connect Direct Connect private connectivity to VPCs across multiple AWS Regions.

Use it when an on-premises data center connects to one Direct Connect location but needs private connectivity to VPCs in more than one AWS Region.

Direct Connect Gateway can be associated with virtual private gateways or transit gateways.

Private VIFs are used with Direct Connect Gateway for private VPC connectivity.

Direct Connect Gateway does not allow direct VPC-to-VPC communication between associated VPCs.

VPC CIDR blocks must not overlap.

A virtual private gateway can be associated with only one Direct Connect Gateway.

A private VIF can be attached to only one Direct Connect Gateway.

Use Transit Gateway when you need scalable routing between multiple VPCs or a regional hub-and-spoke network design.

Flashcards

Q: What is AWS Direct Connect Gateway used for?
A: It is used to connect an AWS Direct Connect connection to VPCs across multiple AWS Regions using private connectivity.

Q: Is Direct Connect Gateway a regional or global resource?
A: Direct Connect Gateway is a global resource.

Q: Is AWS Direct Connect itself global?
A: No. Direct Connect connections are established through specific Direct Connect locations. Direct Connect Gateway provides a global routing construct for reaching VPCs in multiple Regions.

Q: What type of virtual interface is used with Direct Connect Gateway for private VPC connectivity?
A: A private VIF.

Q: Can a public VIF be created to a Direct Connect Gateway?
A: No. Public VIFs are not used with Direct Connect Gateway for private VPC connectivity.

Q: What AWS gateways can be associated with a Direct Connect Gateway?
A: A virtual private gateway or a transit gateway.

Q: When would you associate Direct Connect Gateway with a Transit Gateway?
A: When you need centralized routing to multiple VPCs, especially within the same Region.

Q: Can VPCs associated with the same Direct Connect Gateway communicate directly with each other through the Direct Connect Gateway?
A: No. Direct Connect Gateway does not support direct VPC-to-VPC communication.

Q: What service is commonly used when multiple VPCs need to communicate through a central hub?
A: AWS Transit Gateway.

Q: Are overlapping CIDR blocks supported with Direct Connect Gateway associations?
A: No. CIDR blocks must not overlap.

Q: Can a virtual private gateway be associated with more than one Direct Connect Gateway?
A: No. A VGW can be associated with only one Direct Connect Gateway.

Q: Can a private VIF be attached to more than one Direct Connect Gateway?
A: No. A private VIF can be attached to only one Direct Connect Gateway.

Q: What routing protocol is used to advertise routes through Direct Connect Gateway?
A: BGP.

Q: What problem does Direct Connect Gateway solve in a multi-region architecture?
A: It avoids the need to provision expensive long-distance private circuits to Direct Connect locations in each geography where AWS VPCs exist.

Q: Is Direct Connect Gateway a full mesh networking solution?
A: No. It connects on-premises networks to associated VPCs or transit gateways, but it does not provide full mesh routing between all attached resources.

Practice Questions

Question 1:
A company has a corporate data center in the United States and a Direct Connect connection to a nearby US Direct Connect location. The company has VPCs in us-west-1 and eu-central-1 and wants private connectivity from the data center to both VPCs. The company wants to avoid provisioning a long-distance private circuit to a European Direct Connect location. What should the solutions architect recommend?

A. Create a public VIF and connect it to both VPCs
B. Use AWS Direct Connect Gateway and associate it with the VPC gateways in both Regions
C. Create VPC peering between the US and European VPCs and route on-premises traffic through the US VPC
D. Create a separate internet VPN connection to the European VPC only

Correct Answer:
B

Explanation:
Direct Connect Gateway is a global resource that allows a Direct Connect connection to provide private connectivity to VPCs across multiple AWS Regions. This avoids the need for separate long-distance circuits to multiple Direct Connect locations.

---

Question 2:
A company has two VPCs associated with the same Direct Connect Gateway through virtual private gateways. The network team expects the VPCs to route traffic directly to each other through the Direct Connect Gateway. What should the solutions architect explain?

A. This is supported if both VPCs are in the same Region
B. This is supported only if a public VIF is used
C. This is not supported; Direct Connect Gateway does not provide direct VPC-to-VPC communication
D. This is supported if both VPCs use overlapping CIDR blocks

Correct Answer:
C

Explanation:
Direct Connect Gateway allows on-premises networks to communicate with associated VPCs, but it does not allow direct communication between VPCs associated with the same Direct Connect Gateway. Transit Gateway or another inter-VPC design is needed.

---

Question 3:
A solutions architect is designing private connectivity from an on-premises data center to many VPCs in the same AWS Region. The company wants centralized routing and scalable VPC connectivity. Which design is most appropriate?

A. Direct Connect Gateway associated with a Transit Gateway
B. Direct Connect Gateway associated with a public VIF
C. One Direct Connect Gateway per subnet
D. A single private VIF attached directly to each EC2 instance

Correct Answer:
A

Explanation:
For multiple VPCs in the same Region, Transit Gateway provides centralized hub-and-spoke routing. Direct Connect Gateway can be associated with Transit Gateway to connect on-premises networks into that regional routing hub.

---

Question 4:
A company wants to associate a virtual private gateway with two different Direct Connect Gateways for redundancy. Is this supported?

A. Yes, if the VPC is in two Availability Zones
B. Yes, if BGP is enabled
C. No, a virtual private gateway cannot be associated with more than one Direct Connect Gateway
D. No, Direct Connect Gateway does not support virtual private gateways

Correct Answer:
C

Explanation:
A virtual private gateway can be associated with only one Direct Connect Gateway. Redundancy should be designed using supported patterns such as multiple Direct Connect connections, redundant routers, and appropriate VIF design.

---

Question 5:
A company has two VPCs with overlapping CIDR blocks and wants to connect them both to on-premises using the same Direct Connect Gateway. What is the main issue?

A. Direct Connect Gateway only supports public IP addresses
B. Direct Connect Gateway requires non-overlapping CIDR blocks
C. Direct Connect Gateway can only connect to one AWS Region
D. Direct Connect Gateway does not support BGP

Correct Answer:
B

Explanation:
Direct Connect Gateway requires non-overlapping CIDR blocks. Overlapping network ranges create routing ambiguity and are not supported in this architecture.