1. What is Direct Connect?

AWS Direct Connect (DX) is a dedicated, private physical connection between your on-premises network and AWS. Unlike VPN, traffic does NOT go over the public internet. It provides consistent, low-latency, high-bandwidth connectivity.

Core Concept Direct Connect = a physical cable from your data center to an AWS Direct Connect location. Traffic travels over a private fiber connection, NOT the public internet. This gives you consistent network performance, lower latency, and higher throughput than a VPN. But it takes weeks–months to set up and costs more.

2. Key Characteristics

  1. Dedicated private connection (does NOT use the public internet)
  2. Consistent network performance: low latency, predictable bandwidth
  3. Speeds: 1 Gbps, 10 Gbps, 100 Gbps (dedicated). 50 Mbps–500 Mbps via partners (hosted).
  4. Setup time: weeks to months (physical fiber installation)
  5. NOT encrypted by default (private but unencrypted). Add VPN on top for encryption.
  6. Supports both private (VPC) and public (AWS public services) access
  7. Requires a Direct Connect location (AWS colocation facility) or partner facility
Important Warning Direct Connect is NOT encrypted. The connection is private (not over the internet), but the data on the wire is NOT encrypted. If you need encryption, establish an IPSec VPN tunnel OVER the Direct Connect connection. The exam tests this: "secure private connection" = DX + VPN on top.

3. Direct Connect Architecture

Direct Connect Architecture:

Your Data Center       DX Location         AWS Region
┌────────────┐   ┌────────────┐   ┌────────────┐
│            │   │            │   │            │
│  Your      │   │  AWS       │   │  VPC       │
│  Router ─────── DX Router ──────   VGW / TGW │
│            │   │            │   │     |      │
│  Servers   │   │ Colocation │   │  Subnets   │
└────────────┘   └────────────┘   └────────────┘
     Dedicated fiber     |   AWS backbone
     (not internet)      |
                    Your equipment
                    or partner cage

4. Virtual Interfaces (VIFs)

After establishing a DX connection, you create virtual interfaces to access AWS resources:

VIF Selection Private VIF = reach resources in ONE VPC (via VGW) or multiple VPCs (via DX Gateway + VGWs). Public VIF = reach AWS public services (S3 API, SQS API) over DX instead of the internet. Transit VIF = reach multiple VPCs via Transit Gateway. For modern multi-VPC architectures, Transit VIF + TGW is preferred.

5. Direct Connect Gateway

  1. Allows a single DX connection to access VPCs in multiple Regions
  2. Without DX Gateway, a DX connection only reaches VPCs in the Region where the DX location is
  3. DX Gateway connects to VGWs in multiple Regions via Private VIFs
  4. Also works with Transit Gateway via Transit VIFs
  5. Global service (not Region-specific)
  6. Does NOT enable VPC-to-VPC communication (only on-prem to VPC)
Without DX Gateway:         With DX Gateway:

  DX → VGW → VPC (1 Region)   DX → DX Gateway → VGW-A → VPC us-east-1
                                            → VGW-B → VPC eu-west-1
                                            → VGW-C → VPC ap-southeast-1

  One DX connection reaches VPCs in multiple Regions!

6. Connection Types


Dedicated Connection

  1. Physical fiber port reserved for you at the DX location
  2. Speeds: 1 Gbps, 10 Gbps, or 100 Gbps
  3. You request via AWS Console, then work with the DX location to get the physical cross-connect
  4. Setup: weeks to months
  5. Best for: high bandwidth, consistent workloads


Hosted Connection

  1. Provisioned by an AWS Direct Connect Partner (e.g., AT&T, Verizon, Equinix)
  2. Speeds: 50 Mbps, 100 Mbps, 200 Mbps, 300 Mbps, 400 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps
  3. The partner provides the connection from their infrastructure to AWS
  4. Easier to set up than dedicated (partner handles physical installation)
  5. Can add or remove capacity on demand (for certain speeds)
  6. Best for: lower bandwidth needs, faster setup, first-time DX users

7. Direct Connect Resiliency

AWS recommends different levels of resiliency based on your requirements:


Maximum Resiliency (Critical Workloads)

  1. Two DX connections at TWO separate DX locations
  2. Each location has its own physical connection
  3. Survives: single device failure, single DX location failure


High Resiliency (Important Workloads)

  1. Two DX connections at ONE DX location
  2. Each connection terminates on a different AWS device
  3. Survives: single device failure. Does NOT survive DX location failure.


DX + VPN Backup

  1. Primary: Direct Connect (high bandwidth, low latency)
  2. Backup: Site-to-Site VPN (lower bandwidth, over the internet, encrypted)
  3. If DX fails, traffic automatically fails over to VPN via BGP routing
  4. Cost-effective alternative to dual-DX for non-critical workloads
Resiliency Options:

Maximum:     DX Location A ── DX Connection 1 ──┐
             DX Location B ── DX Connection 2 ──┤── VGW/TGW
             (survives full location failure)    │

High:        DX Location A ── DX Connection 1 ──┤
             DX Location A ── DX Connection 2 ──┤── VGW/TGW
             (survives device failure only)      │

DX + VPN:    DX Location A ── DX Connection ────┤
             Internet ───── VPN (backup) ─────┤── VGW/TGW
             (cost-effective, encrypted backup)  │

8. Encryption on Direct Connect

  1. DX is NOT encrypted by default — traffic is private but unencrypted
  2. Solution 1: Create an IPSec VPN tunnel OVER the DX connection (most common)
  3. Solution 2: Use MACsec (IEEE 802.1AE) for Layer 2 encryption — available on 10 Gbps and 100 Gbps dedicated connections
  4. MACsec encrypts at the link layer (line-rate encryption, no bandwidth overhead)

9. Direct Connect + Site-to-Site VPN Comparison

10. Hybrid Connectivity Decision Table

Exam Tip Direct Connect: "Dedicated private connection, consistent latency" = Direct Connect. "Quick setup, encrypted" = VPN. "High bandwidth to AWS" = DX (1/10/100 Gbps). "DX is NOT encrypted" = add VPN on top of or MACsec. "Access multiple Regions from one DX" = DX Gateway. "Multiple VPCs from DX" = Transit VIF + TGW. "DX + VPN" = common exam pattern for encrypted backup. Setup time: VPN = minutes, DX = weeks–months.