AWS Direct Connect

What it is

AWS Direct Connect links your internal network to a Direct Connect location over a standard Ethernet fiber-optic cable: one end connects to your router, the other to a Direct Connect router. Traffic to your VPCs and to public AWS services then bypasses internet service providers, which gives more consistent bandwidth and LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry and can lower data transfer costs for large volumes.

Choose Direct Connect when a question asks for a dedicated, private, consistent connection between On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry and AWS, for large, steady data transfers, or for hybrid workloads that need predictable latency. Setting up a new connection can take weeks, so for something needed now, start with Site-to-Site VPN.

Connections

Dedicated connection: a physical port for you at a Direct Connect location, at 1, 10, 100, or 400 Gbps. You can't change the port speed later.
Hosted connection: provided through an AWS Direct Connect Partner, from 50 Mbps up to 25 Gbps. Only the Partner can change a hosted connection's speed, and only if the Partner supports upgrades.
Link aggregation group (LAG): bundle several connections at one location into a single logical connection, using LACP, for more bandwidth.

Virtual interfaces (VIFs)

VIF	Reaches	Use
Private VIF	A VPC, through a virtual private gateway or a Direct Connect gateway	Private IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry access to VPCs
Public VIF	All AWS public services (such as S3) using public IP addresses	Reach public endpoints without the internet
Transit VIF	One or more transit gateways, through a Direct Connect gateway	Many VPCs through Transit Gateway

A Direct Connect gateway lets one connection reach VPCs in any account and in the same or different AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry, through virtual private gateways or transit gateways (or a Cloud WAN core network).
SiteLink connects your sites to each other through Direct Connect locations over the AWS network, without going through a Region.
One connection in a public Region can reach public AWS services in all other public Regions.

Direct Connect. A router in your data center has a dedicated link to a Direct Connect location. A private virtual interface goes from the location to a Direct Connect gateway, which reaches a VPC in Region A and a VPC in Region B. A public virtual interface reaches AWS public services such as Amazon S3. A Site-to-Site VPN over the internet is a standby backup.

Security, resilience, performance, and cost

Security

Direct Connect does not encrypt traffic by default. To encrypt:
- Use MACsec, layer 2 encryption on supported dedicated connections and LAGs.
- Or run an IPsec VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry over Direct Connect (Private IP VPN).
- Or use TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry at the application layer.

Resilience

The Direct Connect Resiliency Toolkit offers models:

Maximum resiliency (for a 99.99% SLA (Service level agreement)A provider's commitment to a level of service, such as a monthly uptime percentage, and what customers receive if it is missed, usually service credits.Glossary entry) and High resiliency (for a 99.9% SLA) both place connections in two Direct Connect locations, and you must meet the SLA's requirements.
Development and test: separate connections on separate devices in one location, for non-critical workloads.

A single connection is a single point of failure, so add a second connection or a Site-to-Site VPN backup.

Performance

Consistent latency and bandwidth; use LAGs or higher port speeds for more capacity.

Cost

Pay for capacity, port hours, and data transfer out through the Direct Connect location. Data transfer out over Direct Connect is cheaper than over the internet, which can lower costs for large volumes.

Direct Connect or another option?

If the requirement is	Choose
Dedicated, consistent, private connection to AWS	AWS Direct Connect
Encrypted connection needed this week	AWS Site-to-Site VPN
Encrypt traffic over Direct Connect	MACsec or IPsec VPN over Direct Connect
Reach many VPCs in many Regions over one connection	Direct Connect gateway with transit VIFs
Reach S3 over Direct Connect	Public VIF, or S3 VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry over a private or transit VIF

Reverse mindmap: when the question points here

Is it AWS Direct Connect?

Yes, when the question says
- Dedicated private connection from the data center leads to Direct Connect
- Consistent network performance, not the internet leads to Direct Connect
- Transfer large volumes to AWS regularly leads to Direct Connect
Choose the setup
- 1, 10, 100, or 400 Gbps port leads to Dedicated connection
- Smaller speeds through a partner leads to Hosted connection
- Access VPCs privately leads to Private VIF
- Access S3 and public AWS services leads to Public VIF
- Many VPCs via Transit Gateway leads to Transit VIF and Direct Connect gateway
- VPCs in other Regions or accounts leads to Direct Connect gateway
Make it safe and resilient
- Encrypt the traffic leads to MACsec or VPN over Direct Connect
- 99.99% availability leads to Maximum resiliency model, multiple locations
- Cheap backup path leads to Site-to-Site VPN
No, when the question says
- Connection needed immediately leads to Site-to-Site VPN

Key takeaways

Direct Connect is a dedicated fiber connection from your network to a Direct Connect location, bypassing the internet for consistent performance.
Dedicated connections run at 1, 10, 100, or 400 Gbps; hosted connections through partners run from 50 Mbps to 25 Gbps.
Private VIFs reach VPCs, public VIFs reach AWS public services, and transit VIFs reach transit gateways; Direct Connect gateways span Regions and accounts.
It isn't encrypted by default: use MACsec or a VPN over it.
Use the Resiliency Toolkit models (99.99% and 99.9% SLAs) and a VPN backup.