AWS Site-to-Site VPN

What it is

AWS Site-to-Site VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry creates encrypted IPsec connections between your On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry network (or a branch office or another cloud) and your VPCs, usually over the internet. It is quick to set up and inexpensive, which makes it a common first connection to AWS and a common backup for Direct Connect.

Choose Site-to-Site VPN when a question asks for an encrypted connection to AWS that can be set up quickly, or a backup path for Direct Connect. For consistent bandwidth and LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry, use AWS Direct Connect.

Components

AWS side: a virtual private gateway, attached to a single VPC, or a transit gateway, which connects the VPN to many VPCs (see AWS Transit Gateway).
Your side: a customer gateway device, your router or firewall, represented in AWS by a customer gateway resource.
Two tunnels per connection, each with its own public IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry address on the AWS side. Configure both tunnels for redundancy, so traffic fails over when one is down for maintenance.
Routing: static routes that you enter, or dynamic routing with BGP (Border Gateway Protocol)The routing protocol that networks use to tell each other which IP address ranges they can reach. AWS Direct Connect and AWS Site-to-Site VPN use BGP to exchange routes between your network and AWS.Glossary entry, which advertises routes automatically and is required for ECMP.
AWS VPN CloudHub: several sites with non-overlapping networks each connect a BGP VPN, with a unique ASN, to the same virtual private gateway. The gateway re-advertises each site's prefixes, so the sites can reach each other as well as the VPC: a low-cost hub and spoke that reuses existing VPN connections.

Site-to-Site VPN. A customer gateway device in your data center connects to a virtual private gateway through two tunnels, tunnel 1 and tunnel 2, and both should be configured. The virtual private gateway connects to the instances in the VPC.

Bandwidth and performance

A standard tunnel supports up to 1.25 Gbps.
Large Bandwidth Tunnels support up to 5 Gbps per tunnel, for VPN connections attached to Transit Gateway or Cloud WAN.
On a transit gateway, ECMP aggregates several VPN tunnels for more bandwidth. It needs dynamic (BGP) routing.
Accelerated Site-to-Site VPN uses AWS Global Accelerator to carry traffic from your customer gateway to the nearest AWS Edge locationAn AWS site in a city, separate from the Regions, where Amazon CloudFront caches content close to users. Route 53, AWS WAF, AWS Shield, and AWS Global Accelerator also use the edge network, which has hundreds of locations.Glossary entry and then across the AWS global network. That gives more consistent performance than the public internet. It requires a transit gateway.
Private IP VPN over Direct Connect: run IPsec over a Direct Connect connection using private IP addresses, to encrypt traffic on Direct Connect.

Security, resilience, performance, and cost

Security

Traffic is encrypted with IPsec. Use strong tunnel options (encryption, integrity, and Diffie-Hellman groups) and restrict which ones AWS accepts if your policy requires it.

Resilience

Use both tunnels. For more resilience, add a second customer gateway device and a second VPN connection, so you can maintain one device while traffic continues through the other. Use VPN as a backup for Direct Connect.

Cost

Pay per VPN connection-hour and for data transfer out. Accelerated VPN adds Global Accelerator charges.

Monitoring

CloudWatch metrics show tunnel state and data in and out; alarm when a tunnel goes down.

Site-to-Site VPN or another option?

If the requirement is	Choose
Encrypted connection to AWS, quickly, over the internet	AWS Site-to-Site VPN
Consistent bandwidth and low, predictable latency	AWS Direct Connect
Encrypt traffic that runs over Direct Connect	Private IP VPN over Direct Connect, or MACsec
Individual users connect from laptops	AWS Client VPN
More VPN bandwidth than one tunnel	Large Bandwidth Tunnels, or ECMP on a transit gateway
Branch offices talk to each other over their existing VPNs	AWS VPN CloudHub

Reverse mindmap: when the question points here

Is it AWS Site-to-Site VPN?

Yes, when the question says
- Encrypted connection between data center and VPC leads to Site-to-Site VPN
- Set up connectivity quickly at low cost leads to Site-to-Site VPN
- Backup for Direct Connect leads to Site-to-Site VPN
Configure it
- One VPC leads to Virtual private gateway
- Many VPCs leads to Transit gateway attachment
- Routes learned automatically leads to BGP dynamic routing
- More than 1.25 Gbps leads to Large Bandwidth Tunnels or ECMP
- More consistent path over long distances leads to Accelerated VPN
- Encrypt over Direct Connect leads to Private IP VPN
- Branches reach each other through one VGW leads to VPN CloudHub
No, when the question says
- Dedicated, consistent connection leads to Direct Connect
- Remote employees leads to Client VPN

Key takeaways

Site-to-Site VPN gives IPsec-encrypted connections between your network and AWS, quickly and cheaply.
The AWS side is a virtual private gateway (one VPC) or a transit gateway (many VPCs); your side is a customer gateway device.
Each connection has two tunnels; configure both. BGP routing advertises routes automatically and enables ECMP.
VPN CloudHub connects branch sites to each other through one virtual private gateway, using BGP.
Standard tunnels reach 1.25 Gbps, Large Bandwidth Tunnels 5 Gbps; ECMP on Transit Gateway aggregates tunnels.
Accelerated VPN uses Global Accelerator; private IP VPN encrypts traffic over Direct Connect.