Skip to main content
CloudCertPrep
Start Practicing

Direct Connect vs Site-to-Site VPN: Choosing Your Hybrid Link

6 min read · Updated 2026-10-27

Both connect your on-premises network to AWS, but they trade differently. Site-to-Site VPN is an IPsec tunnel over the public internet — fast to provision, cheap, dependent on internet quality. Direct Connect is a dedicated physical circuit via a DX location — consistent bandwidth and latency, private, but takes weeks to provision and costs more.

The standard enterprise answer is often 'both': DX as the primary path, VPN as encrypted backup or failover.

Site-to-Site VPN: the quick encrypted tunnel

Choose VPN for: quick setup, low traffic volumes, backup connectivity to DX, or reaching resources where a DX location isn't feasible.

  • Two IPsec tunnels per connection for built-in failover
  • Provisions in minutes — just a customer gateway device and config
  • Runs over the internet — bandwidth/latency vary with your ISP path
  • Encapsulation is encrypted end to end (IPsec)
  • Throughput ~1.25 Gbps per tunnel on a VGW (more via TGW/ECMP)

Direct Connect: the dedicated circuit

Choose DX for: steady high-throughput workloads, latency-sensitive apps, compliance requiring private paths, or reducing data-transfer costs at scale.

  • Private physical connection — bypasses the internet entirely
  • Consistent low latency and bandwidth (dedicated 1/10/100 Gbps or hosted 50 Mbps–10 Gbps)
  • Weeks to provision — involves a carrier and a DX location
  • NOT encrypted by default — add MACsec (supported ports) or run a VPN over DX
  • Virtual interfaces: private VIF (VPCs), public VIF (AWS public endpoints), transit VIF (TGW)

Resilience and the hybrid answer

A single DX connection is a single point of failure — the reference design is two connections at separate DX locations, optionally with a Site-to-Site VPN as tertiary failover. VPN over a public VIF on DX adds encryption to a private path.

  • 'Provision in days, low cost, moderate bandwidth' → Site-to-Site VPN
  • 'Consistent latency/bandwidth, private connectivity' → Direct Connect
  • 'Encrypt traffic on DX' → MACsec on supported ports or VPN over public VIF
  • 'Resilient production hybrid' → dual DX + VPN backup
  • 'Backup when DX fails' → Site-to-Site VPN as failover path

Official references