AWS Academy Cloud Architecting — Module 7: Connecting Networks

Module Objective: Choose and design an appropriate connectivity option for linking an AWS VPC to on-premises networks or other VPCs.

Builds on Module 6: This module extends the single-VPC design from Module 6 to scenarios spanning multiple networks.

Connectivity Options Overview

Many real architectures aren't AWS-only — an on-premises data center, a branch office, or another cloud provider often needs to connect into the VPC designed in Module 6. AWS offers several connectivity options, each fitting a different combination of bandwidth, latency, and cost requirements.

Option	Best For
Site-to-Site VPN	Quick to set up, encrypted connection over the public internet
AWS Direct Connect	Dedicated, private, high-bandwidth connection to AWS, bypassing the public internet
AWS Transit Gateway	Centrally connecting many VPCs and on-premises networks through one hub

🔵 Note These options aren't mutually exclusive — a common resilient pattern pairs AWS Direct Connect as the primary path with a Site-to-Site VPN as a backup.

Site-to-Site VPN Connections

An AWS Site-to-Site VPN creates an encrypted IPsec tunnel between an on-premises router and a VPC, reachable in minutes and requiring no new physical infrastructure — making it the fastest way to establish hybrid connectivity.

✅ Tip — Good for Getting Started, Not Always for Scale VPN throughput is bounded by internet conditions and the tunnel's own limits. It's an excellent starting point or a resilient backup, but sustained high-bandwidth workloads often outgrow it.

AWS Direct Connect

AWS Direct Connect (introduced briefly in AWS Academy Cloud Foundations Module 3) establishes a dedicated, private network connection from a customer's premises to AWS, avoiding the public internet entirely — offering more consistent bandwidth and lower latency than a VPN.

⚠️ Warning — Direct Connect Takes Time to Provision Unlike a VPN, which can be active almost immediately, Direct Connect typically involves a physical cross-connect through an AWS Direct Connect location and can take weeks to provision — plan for that lead time.

AWS Transit Gateway

As the number of VPCs and on-premises connections grows, managing individual VPC peering connections (Module 6) between every pair becomes unwieldy. AWS Transit Gateway acts as a central hub, so each VPC or network connects once to the gateway instead of to every other network individually.

Without Transit Gateway	With Transit Gateway
Each VPC pair needs its own peering connection	Each VPC connects once to the gateway
Connections grow quadratically with VPC count	Connections grow linearly with VPC count

✅ Tip — Think "Hub and Spoke" Transit Gateway turns a mesh of point-to-point connections into a hub-and-spoke model, which is dramatically easier to manage and reason about as an architecture scales past a handful of VPCs.

Hybrid Networking Considerations

Choosing among these options is a matter of balancing setup speed, cost, bandwidth, and resiliency needs — and often combining more than one for redundancy in a production architecture.

🔵 Note For the café case study, a growing chain with many locations might start with Site-to-Site VPN at smaller locations and move to Direct Connect and Transit Gateway as data volume and the number of connected sites grow.

Key Terms for Module 7

Site-to-Site VPN: An encrypted IPsec connection between an on-premises network and a VPC over the public internet
AWS Direct Connect: A dedicated, private network connection between a customer's premises and AWS
AWS Transit Gateway: A central hub connecting many VPCs and on-premises networks without a full mesh of peering connections
hub-and-spoke model: A network topology where every network connects once to a central hub rather than directly to every other network

Review Questions

What is the main trade-off between Site-to-Site VPN and AWS Direct Connect?
Why might an architecture use both AWS Direct Connect and a Site-to-Site VPN together?
What problem does AWS Transit Gateway solve as the number of connected VPCs grows?
How does connection complexity scale with VPC count, with and without Transit Gateway?