AWS Architecture Guide

Site-to-Site VPN, Direct Connect, and Redundant Links

Goal

Once you know where shared connectivity should live, the next question is how that connectivity reaches AWS.

This section compares AWS Site-to-Site VPN and AWS Direct Connect in practical design terms.

The Short Version

AWS describes Site-to-Site VPN as an IPsec VPN connection between your VPC and your on-premises network. AWS also notes that each VPN connection includes two VPN tunnels for high availability. AWS describes Direct Connect as a dedicated network connection from your internal network to an AWS Direct Connect location over standard Ethernet fiber.

That leads to the architecture rule:

Hybrid links should be chosen by required reliability, bandwidth, lead time, and risk tolerance, not by habit.

VPN is often faster to adopt and flexible enough for many cases. Direct Connect is valuable when a business needs more dedicated private connectivity characteristics. Many enterprise designs use both.

When Site-to-Site VPN Fits

VPN is often a strong first or ongoing choice when:

  • the organization needs connectivity quickly

  • the traffic profile is moderate

  • the business can tolerate internet-based path characteristics

  • the team wants a practical backup path even when another primary link exists

The fact that AWS provides two VPN tunnels per connection is especially important. Even when VPN is not the primary long-term path, it often remains part of the resilience story.

When Direct Connect Fits

Direct Connect changes the conversation because it bypasses ordinary internet service provider paths in the network route between your environment and AWS. That can be useful when the business needs a more dedicated connectivity pattern, predictable private access to VPCs or AWS public services, or a stronger long-term hybrid foundation.

But Direct Connect also brings trade-offs:

  • provisioning lead time

  • physical connectivity planning

  • added cost

  • operational coordination with facilities and network teams

So Direct Connect is not "better" in every case. It is better when its benefits match the importance of the systems depending on it.

Redundancy Matters as Much as the Primary Link

Architects sometimes focus too much on naming the primary connection type and not enough on recovery behavior.

A stronger question is:

If this path fails, what happens to the workloads and how quickly must service be restored?

That is why hybrid designs often combine approaches:

On-prem
  -> VPN over internet -> AWS
  -> Direct Connect -> AWS
  -> Tested failover path

The right combination depends on business criticality, not on what sounds most advanced.

Example: Critical Internal Systems

A company is moving line-of-business systems to AWS, but some identity, ERP, and integration systems remain on-premises. The business can launch with VPN quickly, but over time decides those dependencies are important enough to justify Direct Connect as part of the steady-state design. VPN remains valuable for backup and transition.

That answer is often more realistic than pretending every hybrid journey starts with the final network shape.

Common Mistakes

  • Treating Direct Connect as automatically required for every hybrid workload.

  • Using VPN without asking whether the business impact of path disruption is acceptable.

  • Designing a critical connection without a tested failover path.

  • Ignoring lead time, contracts, and operational ownership while comparing only technical performance.

If Someone Asks You

How would you choose between Site-to-Site VPN and Direct Connect?

A good answer is:

I would choose based on business criticality and operating needs. VPN is often faster and flexible, and AWS provides two tunnels for availability. Direct Connect is stronger when the business needs dedicated private connectivity characteristics and is willing to accept the extra lead time and cost. For critical hybrid estates, the answer is often both, with clear failover expectations.

What You Should Remember

The right hybrid link is the one whose reliability, bandwidth, cost, and recovery model match the business impact of failure.

Questions to Check Your Understanding

  1. Why is VPN often a reasonable starting point in hybrid AWS environments?

  2. What business conditions make Direct Connect more attractive?

  3. Why should redundancy planning be discussed alongside the primary link choice?