SysPad › Lessons › networking lessons › Direct Connect

How Direct Connect works

Dedicated private network link between on-premises and AWS for consistent bandwidth and lower, more predictable latency than the public internet. Billed a port-hour fee by speed + per-GB data-transfer-out.

You can connect a data centre to AWS over a VPN in an afternoon, but it shares the public internet, so on a bad day your database replication stutters. Direct Connect is a dedicated physical fibre into AWS: it takes weeks to install, yet gives you bandwidth and latency you can actually count on.

What you will learn

Why can a VPN over the internet be unpredictable for steady, heavy traffic?
What does a dedicated physical connection to AWS buy you?
What are virtual interfaces, and how does one fibre reach VPCs and public services?
Why pair Direct Connect with a VPN, and how does its pricing differ?

The internet-VPN ceiling

A Site-to-Site VPN tunnels your on-prem network to AWS over the public internet. It is encrypted and fast to stand up, but you share the path with everyone else, so latency jitters and throughput is capped by whatever the internet gives you that moment.

A private lane into AWS

Direct Connect is a dedicated fibre link from your network to an AWS Direct Connect location, in 1, 10, or 100 Gbps port sizes (smaller hosted connections exist via partners). Because the path is private and reserved, bandwidth and latency are consistent.

⚓ Large data migrations, hybrid databases that replicate constantly, media houses moving huge files, and any workload where a jittery link is unacceptable.

Virtual interfaces on one fibre

A single physical connection is sliced into virtual interfaces (VIFs): a private VIF reaches a VPC, a public VIF reaches AWS public services (like S3) over the dedicated line, and a transit VIF hooks into a Transit Gateway to fan out to many VPCs at once.

Pair it with a VPN, and the bill

Provisioning takes weeks (physical cross-connects), and one fibre is a single point of failure. The common pattern is a backup VPN over the internet so traffic fails over if the line drops. For real resilience, two Direct Connects in different locations.

Flashcards

Why might an internet VPN disappoint for constant heavy replication?: It shares the public internet, so latency and throughput vary; it is easy to set up but not predictable.
What is the defining property of Direct Connect?: A dedicated private fibre to an AWS location giving consistent bandwidth and latency, in 1/10/100 Gbps ports.
What are the three virtual interface types?: Private VIF (to a VPC), public VIF (to AWS public services), and transit VIF (to a Transit Gateway).
Is Direct Connect encrypted by default?: No. The link is private but not encrypted; run a VPN over it (or MACsec) if you need encryption.
Why is a backup VPN common alongside Direct Connect?: A single fibre is a single point of failure and takes weeks to provision; a VPN gives cheap failover until you add a second DX.

Sources

Open the SysPad canvas · Official Direct Connect documentation