VPN and AWS Direct Connect

Most organisations do not run everything in the cloud. They have on-premises data centres, branch offices, or co-location facilities that need to communicate securely with their AWS VPCs. AWS provides two primary connectivity options: Site-to-Site VPN for encrypted tunnels over the public internet, and AWS Direct Connect for dedicated private network links. This lesson compares both and explains when to use each.

---

AWS Site-to-Site VPN

A Site-to-Site VPN creates an encrypted IPsec tunnel between your on-premises network and your AWS VPC over the public internet.

Components

Component	Where	Purpose
Virtual Private Gateway (VGW)	AWS side	VPN endpoint attached to a VPC
Customer Gateway (CGW)	On-premises side	Represents your on-premises router/firewall
VPN Connection	Between VGW and CGW	The encrypted tunnel(s)

Architecture

On-Premises Network
  ┌──────────────────┐
  │ Customer Gateway  │  (your router)
  │  Public IP: x.x.x.x │
  └────────┬─────────┘
           │  IPsec tunnel (encrypted)
           │  over the public internet
           ▼
  ┌──────────────────┐
  │ Virtual Private   │  (AWS-managed)
  │ Gateway (VGW)     │
  └────────┬─────────┘
           │
           ▼
  ┌──────────────────┐
  │     VPC          │
  │  10.0.0.0/16     │
  └──────────────────┘

Key Properties