VPN connections over the public internet are the right starting point for hybrid connectivity. They are quick to set up, cheap, and often sufficient for workloads with modest throughput requirements and tolerance for variable latency. But as workloads mature, requirements tighten. Latency needs to be predictable. Throughput needs to be reliable. Compliance frameworks mandate that sensitive data does not traverse shared infrastructure.

AWS Direct Connect gives you a dedicated private connection between your on-premises network and AWS. Traffic never hits the public internet. Latency is consistent. Throughput is as high as 100 Gbps per connection. In this article I will walk through connection types, virtual interfaces, BGP configuration, and the architecture needed for production-grade redundancy.

Connection Types

Dedicated connections are physical ports at AWS Direct Connect locations, available in 1 Gbps, 10 Gbps, and 100 Gbps. You work with a Direct Connect partner to provision a cross-connect from your cage or circuit to the AWS port. This is the highest-performance option and gives you the most control.

Hosted connections are provisioned through AWS Direct Connect partners and support speeds from 50 Mbps to 10 Gbps. Partners provision capacity on their equipment and offer you a logical connection at your chosen bandwidth. Hosted connections are faster to provision and require no physical presence at a Direct Connect location.

Virtual Interfaces

A Direct Connect connection is a physical link. Virtual interfaces (VIFs) are the logical connections you create on top of it. Three types exist. Private VIFs connect to VPCs using private IP addressing. Public VIFs connect to public AWS services like S3 and DynamoDB endpoints over private connectivity. Transit VIFs connect to Transit Gateway for access to multiple VPCs through a single VIF.

resource "aws_dx_connection" "primary" {
  name      = "dc-primary"
  bandwidth = "10Gbps"
  location  = "EqDC2"

  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

resource "aws_dx_gateway" "main" {
  name            = "production-dx-gateway"
  amazon_side_asn = "64512"
}

resource "aws_dx_gateway_association" "vpc" {
  dx_gateway_id         = aws_dx_gateway.main.id
  associated_gateway_id = aws_vpn_gateway.main.id

  allowed_prefixes = [
    "10.0.0.0/8",
    "172.16.0.0/12"
  ]
}

resource "aws_dx_transit_virtual_interface" "primary" {
  connection_id    = aws_dx_connection.primary.id
  name             = "transit-vif-primary"
  vlan             = 100
  address_family   = "ipv4"
  bgp_asn          = 65000
  amazon_address   = "169.254.0.1/30"
  customer_address = "169.254.0.2/30"
  bgp_auth_key     = var.bgp_auth_key
  dx_gateway_id    = aws_dx_gateway.main.id

  tags = { Name = "primary-transit-vif" }
}

BGP authentication using bgp_auth_key adds MD5 authentication to the BGP session between your router and AWS. This prevents BGP hijacking by requiring both sides to know the shared secret. Use a randomly generated key of at least 32 characters stored in Secrets Manager. The key must match on both the AWS side (configured here) and your router configuration.

Redundancy Architecture for 99.99 Percent SLA

A single Direct Connect connection provides a 99.9 percent SLA. To reach 99.99 percent you need two connections in different Direct Connect locations. AWS requires connections at separate locations to qualify for the maximum SLA, since a single location going offline would take both connections with it.

resource "aws_dx_connection" "secondary" {
  name      = "dc-secondary"
  bandwidth = "10Gbps"
  location  = "EqSV5"

  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

resource "aws_dx_transit_virtual_interface" "secondary" {
  connection_id    = aws_dx_connection.secondary.id
  name             = "transit-vif-secondary"
  vlan             = 200
  address_family   = "ipv4"
  bgp_asn          = 65000
  amazon_address   = "169.254.1.1/30"
  customer_address = "169.254.1.2/30"
  bgp_auth_key     = var.bgp_auth_key
  dx_gateway_id    = aws_dx_gateway.main.id

  tags = { Name = "secondary-transit-vif" }
}

resource "aws_vpn_connection" "backup" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.onprem.id
  type                = "ipsec.1"
  static_routes_only  = false

  tags = { Name = "dx-backup-vpn" }
}

The VPN backup is not strictly required for the 99.99 percent Direct Connect SLA, but it provides a safety net for complete Direct Connect failure scenarios and for initial testing before both Direct Connect connections are live. Configure BGP to prefer Direct Connect routes over VPN routes using local preference or MED attributes. VPN traffic is slower and metered differently, so it should only activate when Direct Connect is unavailable.

Link Aggregation Groups

If you need more than 10 Gbps through a single location, you can aggregate up to four connections into a Link Aggregation Group. The LAG presents as a single managed connection with the combined bandwidth and automatic failover between member links.

resource "aws_dx_lag" "primary" {
  name                  = "primary-lag"
  connections_bandwidth = "10Gbps"
  location              = "EqDC2"
  force_destroy         = false
  min_links             = 1

  tags = { Name = "primary-lag" }
}

min_links = 1 means the LAG stays active as long as at least one member connection is up. Setting it to 2 would mean the LAG goes down if only one connection remains, which forces failover to the secondary location. The right value depends on your traffic profile. If a single 10 Gbps connection is insufficient for your workload, set min_links to 2 so partial failure forces full failover rather than operating in a degraded state.

Monitoring Direct Connect

CloudWatch publishes Direct Connect metrics automatically. ConnectionState is the most important: a value of 0 means the connection is down. Set an alarm with a threshold of 0 and a period of 60 seconds so you know within a minute if a connection fails. Also monitor ConnectionBpsIngress and ConnectionBpsEgress to watch for bandwidth saturation. A connection consistently above 80 percent utilization needs additional capacity before it becomes a bottleneck.

Closing Thoughts

Direct Connect is the right choice when consistent latency, high throughput, or data sovereignty requirements make VPN over the public internet inadequate. The provisioning lead time is measured in weeks rather than minutes, so plan ahead. Use Transit VIFs with Direct Connect Gateway to connect all your VPCs through a single logical interface. Always provision two connections in separate locations and monitor both continuously.

Enjoy the cloud.

Osama

---

#AWS #DirectConnect #HybridCloud #NetworkEngineering #CloudArchitecture #Terraform #InfrastructureAsCode #AmazonWebServices #SolutionsArchitect #CloudComputing #BGP #NetworkDesign #CloudConnectivity #TechBlog #CloudInfrastructure #EnterpriseCloud #DataCenter #SRE #CloudSecurity #DevOps