Direct Connect

VPN connections ride over the unpredictable public internet — fine for many workloads, but not for consistent low-latency, high-throughput, or highly sensitive traffic. AWS Direct Connect solves this by establishing a dedicated physical network connection from your data center (or a colocation facility) directly into AWS, entirely bypassing the public internet, with consistent bandwidth and lower, more predictable latency.

• A Direct Connect connection terminates at a specific AWS Direct Connect location and is tied to that location/region pair.
• A Direct Connect Gateway lets a single connection reach VPCs across multiple regions (except China), decoupling the physical link from any one region.
• Connections come in two flavors: dedicated (a physical fiber cross-connect, 1/10/100 Gbps) and hosted (provisioned via an AWS Direct Connect Partner, smaller increments).

graph LR
DC["Your Data Center"] --> DX["Direct Connect (private link)"]
DX --> DXGW["Direct Connect Gateway"]
DXGW --> VPC1["VPC — Region A"]
DXGW --> VPC2["VPC — Region B"]
classDef vpc fill:transparent,stroke:#8b3de0,stroke-width:2px
class VPC1,VPC2 vpc

Direct Connect bills port-hour charges for the connection itself plus data transfer out — but at meaningfully lower per-GB rates than internet-based transfer, which is exactly why high-volume, steady-state workloads (large data migrations, hybrid architectures) favor it once the up-front setup is done.

• Setting up Direct Connect typically takes weeks to a month (physical cross-connects) — the exam frequently pairs this with Site-to-Site VPN as a fast, temporary failover while Direct Connect is being provisioned.
• Direct Connect traffic is not encrypted by default — if you need encryption over it, layer a VPN over Direct Connect (a specific supported combination) on top.
• Direct Connect Gateway is the key to a multi-region hybrid design from a single physical connection — know that plain Direct Connect alone is single-region.
• For resilience, AWS recommends at least two connections at two different Direct Connect locations to avoid a single point of failure.