Task Statement 4.3: Implement and maintain confidentiality of data andcommunications of the network.
📘AWS Certified Advanced Networking – Specialty
1. What this concept means
VPN connectivity over AWS Direct Connect (DX) means:
- You use AWS Direct Connect as the network path (underlay)
- And you still run a Site-to-Site IPsec VPN on top of it (overlay)
So even though traffic is already going through a private dedicated connection (Direct Connect), you still encrypt the data using IPsec VPN tunnels.
👉 Key idea:
- Direct Connect = private, high-speed network link
- VPN (IPsec) = encryption layer for confidentiality
- Together = private + encrypted communication
2. Why this is used (very important for exams)
In AWS networking, Direct Connect is:
- NOT encrypted by default
So organizations use VPN over Direct Connect when they need:
- Strong data confidentiality (encryption in transit)
- Compliance requirements (regulated industries)
- Private connectivity with encryption
- More predictable performance than internet VPN
3. Architecture components
To understand VPN over DX, you must know these components:
1. AWS Direct Connect
- Dedicated physical network connection from on-premises to AWS
- Uses:
- Private VIF (Virtual Interface) for VPC private access
- Public VIF for AWS public services (like VPN endpoints)
2. VPN Connection (IPsec tunnels)
- Creates encrypted tunnels between:
- Customer gateway (on-premises device)
- AWS VPN endpoint (VGW or Transit Gateway)
3. AWS VPN endpoints
- Either:
- Virtual Private Gateway (VGW), or
- Transit Gateway (TGW)
4. How VPN over Direct Connect works (step-by-step)
Step 1: Direct Connect is established
- On-premises network connects to AWS via DX
- BGP is used for route exchange
Step 2: VPN is created
- IPsec VPN tunnels are configured between:
- Customer Gateway (on-premises router/firewall)
- AWS VPN Gateway (VGW or TGW)
Step 3: Traffic flow uses Direct Connect as transport
Instead of going over the internet:
- VPN tunnel traffic is routed through Direct Connect
- This is done using:
- Public VIF (most common for VPN over DX)
Step 4: Encryption happens inside VPN tunnel
- Even though DX is private, data is still:
- Encapsulated in IPsec
- Encrypted end-to-end
5. Routing behavior (important for exam questions)
- BGP (Border Gateway Protocol) is used for routing
- Routes can be exchanged between:
- On-premises network
- AWS VGW or TGW
You can configure:
- Primary path: Direct Connect (VPN over DX)
- Backup path: Internet-based VPN
This provides:
- High availability
- Failover if DX fails
6. Direct Connect Gateway + Transit Gateway scenario (advanced exam point)
In large environments:
- Multiple VPCs connect using Transit Gateway (TGW)
- Direct Connect connects using:
- Direct Connect Gateway (DXGW)
Flow:
- On-prem → DX → DXGW → TGW → VPCs
- VPN tunnels can terminate at TGW and still use DX as transport
7. Security behavior (very important)
| Layer | Security Role |
|---|---|
| Direct Connect | Private network path (no encryption by default) |
| IPsec VPN | Encryption of data in transit |
| Combined | Private + encrypted communication |
So:
- Even if DX is compromised physically, data is still encrypted
- VPN ensures confidentiality and integrity
8. Key advantages (exam-friendly points)
VPN over Direct Connect provides:
- Encryption of traffic over private link
- Lower latency than internet-based VPN
- More stable performance
- Better compliance support
- Hybrid redundancy design (DX + VPN fallback)
9. Limitations / considerations
- More complex setup than plain VPN or DX alone
- Extra encryption overhead (CPU usage on devices)
- Requires correct BGP and routing design
- MTU/fragmentation must be carefully handled due to IPsec overhead
10. Common exam scenarios
You may see questions like:
Scenario 1:
“Company needs encrypted communication between on-premises and AWS with high bandwidth and low latency”
✔ Answer:
- VPN over Direct Connect
Scenario 2:
“Direct Connect is required, but data must still be encrypted in transit”
✔ Answer:
- IPsec VPN over Direct Connect
Scenario 3:
“Need private connectivity and encryption, with failover to internet VPN”
✔ Answer:
- DX primary + VPN over DX + backup internet VPN
11. Simple summary (for revision)
VPN over Direct Connect means:
- Direct Connect provides private high-speed connection
- IPsec VPN provides encryption
- Together they provide secure and reliable hybrid connectivity
- Routing is managed using BGP
- Traffic is still encrypted even though it does not use the public internet
