Direct Connect: From the Cable Up
Direct Connect is the one AWS service with a real cable in the real world. So we'll build it from the ground up, starting at the fibre and climbing to global routing.
From your mentor
A VPN rides the public internet; Direct Connect is a private fibre you actually run into an AWS facility. Picture the physical cable first, everything logical (ports, VIFs, gateways) just stacks on top of it.
Direct Connect is just a private cable from your data center to AWS, no public internet.
In 12 minutes you’ll build it from the fibre up. You do NOT need MACsec or LAG details yet.
Pick your way in, same idea, 5 doors
A VPN sends your traffic over the public internet in a locked box. Direct Connect skips the internet entirely, it’s your own private cable straight into AWS. Faster, steadier, more predictable.
Start at the cable
Forget the abstractions for a second. Direct Connect begins as a physical fibre patch inside a data centre, and everything else is a layer on top.
L4Direct Connect Gateway
A global object that lets one connection reach VPCs and Transit Gateways in any AWS region.
L3Virtual interfaces (VIFs)
Logical interfaces over the port: Private (a VPC), Public (S3 & public AWS), or Transit (a Transit Gateway).
L2The connection (port)
Dedicated, your own 1/10/100/400 Gbps port, or Hosted, where a partner carves 50 Mbps–25 Gbps off theirs.
L1Physical cross-connect
A fibre cable patched between your router and AWS inside a Direct Connect location (colo). AWS issues an LOA-CFA; the colo runs the patch.
Start here, the cable in the ground ▼
In plain English
The connection: dedicated vs hosted
Your first real choice is how you get the port, your own, or a slice of a partner's.
| Dedicated | Hosted | |
|---|---|---|
| What you get | Your own physical port from AWS | A virtual slice from a Direct Connect partner |
| Speeds | 1, 10, 100, or 400 Gbps | 50 Mbps → 25 Gbps (partner-provisioned) |
| Setup | You order the port + arrange the cross-connect | Partner provisions it, faster to start |
| Best for | High, steady bandwidth you control | Smaller/sub-1G needs, quicker onboarding |
The LOA-CFA and the 90-day clock
AWS gives you an LOA-CFA (Letter of Authorization), the document that authorizes the colo to patch your cable to AWS. If the cross-connect isn’t completed within 90 days, the authorization expires and you start over.Virtual interfaces, what the line actually reaches
One physical port carries logical 'virtual interfaces.' The VIF type decides what you can talk to.
| VIF type | Reaches | Use it for |
|---|---|---|
| Private VIF | A VPC (via a VGW or Direct Connect Gateway) | Private access to one or a few VPCs |
| Public VIF | Public AWS services (S3, public endpoints) over the line | A private path to public AWS services |
| Transit VIF | A Transit Gateway (via a DX Gateway) | Many VPCs / multi-region at scale |
SiteLink, your sites, over AWS’s backbone
A bonus on private/transit VIFs: SiteLink connects two Direct Connect locations to each other through the AWS global backbone, letting your own offices talk via AWS’s network instead of the public internet.Direct Connect Gateway, go global
A single connection in one location can still reach AWS everywhere, thanks to one global object.
A Direct Connect Gateway is a global resource that groups your private VIFs with VGWs and Transit Gateways. One connection in, say, Frankfurt can reach VPCs in Tokyo and Virginia through it, you don’t need a separate cable per region.
Nice, that’s the win
The gotcha: Direct Connect is NOT encrypted by default
A private line feels secure, but private isn't the same as encrypted. This catches people, and auditors.
Careful here
| Option | How | Notes |
|---|---|---|
| MACsec | Layer-2 encryption on the cross-connect | Dedicated 10/100 Gbps only, at select locations |
| VPN over Direct Connect | Run an IPsec Site-to-Site VPN across a public VIF | Works anywhere; adds IPsec overhead |
Resilience models
A single cable is a single point of failure. AWS frames redundancy as three tiers, pick by how much downtime you can tolerate.
1 connection · 1 location
Non-critical / testing. A single fibre cut or device failure takes you down.
2 connections · 2 locations
Survives a device failure or a fibre cut, one connection at each of two locations.
Separate devices · 2+ locations
For critical workloads, survives a complete location failure. Separate connections on separate devices across locations.
LAG for bandwidth, not just resilience
A Link Aggregation Group (LAG) bundles multiple connections at one location into a single managed interface (LACP), up to two 100/400 Gbps or four sub-100 Gbps links. It’s for aggregating bandwidth and simplifying config; it does not replace multi-location resilience. (Dedicated connections only.)The cost model
Three dials, and the one that makes Direct Connect attractive at scale.
| Charge | How it works |
|---|---|
| Port hours | Billed by capacity for every hour the port is provisioned, even with zero traffic |
| Data transfer OUT | Per GB, but cheaper than internet egress, the savings that justify DX at volume |
| Data transfer IN | $0.00 per GB |
When the maths works
DX has real fixed costs (port hours + the cross-connect), so it pays off at steady, high volume where the cheaper egress and consistent performance outweigh the line rental. Low or bursty traffic? A VPN is usually the better deal.The climb
From cheap-and-shared to a dedicated, encrypted, location-redundant backbone.
- Rung 0 · Naive
VPN over the internet only
Rely solely on an IPsec VPN across the public internet.
Fine to start, but performance is variable and bandwidth is capped, not for heavy, steady, latency-sensitive traffic. - Better
A single Direct Connect (Development)
Provision one dedicated connection at one location with the VIFs you need.
Private, consistent, high bandwidth, but one cable is a single point of failure. - Best practice today
Multi-location DX + VPN backup, encrypted
Two+ connections across locations (High/Maximum), a VPN as encrypted failover, MACsec or VPN-over-DX for data in motion, fronted by a DX Gateway + Transit Gateway.
Consistent performance, survives a full location outage, encrypted end-to-end, and reaches every region, production-grade hybrid networking.
How this shows up in interviews
“We need a fast, reliable, private link from our data centre to AWS. Direct Connect, how, and what are the catches?”
How to answer it
Build it up: physical connection → VIFs → DX Gateway, then nail the two things candidates miss, it isn't encrypted by default, and one line isn't resilient.
- 1A Direct Connect connection (dedicated for high steady bandwidth, or hosted via a partner) into a DX location.
- 2Private VIF to reach VPCs, or a Transit VIF + Direct Connect Gateway to reach many VPCs/regions through Transit Gateways.
- 3It is not encrypted by default, add MACsec (dedicated 10/100G) or run a VPN over Direct Connect for sensitive data.
- 4One connection is a single point of failure: use two connections across two locations (High/Maximum resilience), often with a VPN as encrypted backup.
- 5Justify it on steady high volume, cheaper egress + consistent latency vs the fixed port-hour cost.
Green flags
- Flags that DX isn’t encrypted by default
- Designs multi-location resilience, not a single line
- Uses DX Gateway + Transit VIF for many VPCs/regions
Red flags
- Assumes a private line is automatically encrypted
- Calls a single connection “highly available”
- Recommends DX for low or bursty traffic
Q.Is Direct Connect encrypted?
A.No, it’s private but plaintext on the wire. Add encryption explicitly.
- MACsec: Layer-2 encryption, dedicated 10/100 Gbps at select locations.
- Or run an IPsec VPN over a public VIF for encryption in transit.
They’re checking: That you know “private” ≠ “encrypted”, a common misconception.
Q.Dedicated vs hosted connection?
A.Dedicated = your own physical port (you arrange the cross-connect); hosted = a partner-provisioned slice, faster to start.
They’re checking: That you size dedicated vs hosted by bandwidth need and lead time.
Q.How do you reach VPCs in multiple regions over one connection?
A.A Direct Connect Gateway, a global object grouping VIFs with VGWs/Transit Gateways across regions.
- A Transit VIF to a DX Gateway fans out to Transit Gateways and VPCs in multiple regions.
- One physical connection, global reach.
They’re checking: That you reach for a DX Gateway for cross-region reach.
Q.How do you make Direct Connect highly available?
A.Multiple connections across multiple locations (AWS’s High or Maximum resilience models), often with a VPN backup.
- So a fibre cut or a whole-location failure doesn’t cut you off.
- A Site-to-Site VPN is the cheap, encrypted backup path.
They’re checking: That you design for location-level failure, not just a second port.
Your turn, explore the logical side (no cable required)
You can't provision real fibre from a laptop, but the logical pieces (and the resiliency wizard) are explorable, and a Direct Connect Gateway is free.
Now do it in your own account
You can’t provision real fibre from a laptop, but the logical pieces and the resiliency wizard are explorable, and a Direct Connect Gateway is free.
Before you start
3 to have readyYour IAM admin user from Lesson 1.
AWS CLI v2 signed in.
aws sts get-caller-identityNo physical cable needed, you build the logical side only.
- 1
Create a Direct Connect Gateway (free, global) with a private ASN.
Free tierYour terminal
aws cli
AWS docs: create-direct-connect-gateway$ aws directconnect create-direct-connect-gateway --direct-connect-gateway-name demo-dxgw --amazon-side-asn 64512You should see: a directConnectGatewayId, the global object VIFs attach to.
- 2
Walk the Resiliency Toolkit wizard for Development / High / Maximum.
Free tierConsole → Direct Connect → Resiliency Toolkit
You should see: how many ports and locations each model orders, and why.
- 3
Read what a real order looks like (don’t submit it).
Free tierConsole → Direct Connect → Connections → Create connection
You should see: the flow where you’d download the LOA-CFA and hand it to your colo.
Don’t actually order a port, real connections bill port-hours from provisioning.
- 4
Inspect connections in your account.
Free tierYour terminal
You should see: an empty list, no real ports, which is expected.
Last step: tear it down
Once you’ve seen it work, remove everything so nothing keeps billing.
Delete the demo DX Gateway to stay tidy.
aws directconnect delete-direct-connect-gateway --direct-connect-gateway-id <id>A DX Gateway is free, and you ordered no real port here.
Real connections bill port-hours from provisioning, traffic or not, never leave a provisioned port idle.
Next up
Related deep dives
Direct Connect pairs with Transit Gateway (Transit VIF → many VPCs) and Site-to-Site VPN (the cheap, encrypted backup). Both have their own pages.