AWS Direct Connect
Dedicated private fiber link between your datacenter and AWS that bypasses the public internet.
Verified against AWS documentation · 2026-08-24
Key facts
- 01Private, not encrypted — DX only guarantees the traffic never touches the internet, not that anyone can't read it
- 02Dedicated: 1/10/100/400 Gbps ordered from AWS. Hosted: 50 Mbps–25 Gbps ordered from a partner
- 03Traffic rides a VIF — private → VPC, public → AWS public endpoints (S3, DynamoDB), transit → Transit Gateway. A Direct Connect Gateway fans one VIF out to VPCs in any Region
- 04Weeks to months to provision; 99.9% SLA on one link, 99.99% only with two links at two DX locations
Exam triggers
Phrases and scenarios that point here.
- "Consistent", "predictable latency", "dedicated bandwidth", "must not traverse the public internet" → Direct Connect
- "Needs to be working next week" or "lowest cost" → Site-to-Site VPN; DX can't be provisioned that fast
- Traffic over DX must be encrypted → IPsec VPN over a public VIF, or MACsec on 10/100/400 Gbps dedicated links
- One circuit reaching many VPCs, or VPCs in other Regions → Direct Connect Gateway; reaching a TGW → transit VIF (1 Gbps minimum)
- "Maximum resiliency" / 99.99% → two connections at two separate DX locations, not two ports in one building
Not this service
- Encrypted tunnel over the internet, up in an hour → Site-to-Site VPN
- Connecting VPCs to each other → Transit Gateway or VPC peering
- Private S3 access from inside a VPC → Gateway VPC endpoint
- One-time bulk move of petabytes with no existing circuit → Snow Family
Use cases
- 01App tier in AWS talking to a database or mainframe that legally or practically can't move — the failure mode is jitter, not throughput
- 02Steady high-volume egress back to a datacenter (nightly replicas, backup restores) where internet egress rates dominate the AWS bill
- 03Latency-sensitive traffic — VDI, SIP/voice, trading feeds — where an internet VPN's variable round-trip time is itself the outage
- 04An auditor or regulator requiring a documented path that never crosses the public internet
- 05Sustained large-file movement (video dailies, genomics batches, DataSync jobs) that outgrows a VPN tunnel's ~1.25 Gbps ceiling
How it's charged
- 01Two AWS line items only: port hours and data transfer out
- 02Port hours bill for every hour the port is provisioned, at zero traffic — you're paying for the circuit, not the packets
- 03Data transfer out is per-GB at DX rates (cheaper than internet egress); the rate depends on the DX location and source Region pair
- 04Data transfer in is free, which is why DX rarely pays for itself on ingest-heavy workloads
- 05Cross-connect, colo space, and partner circuit fees never appear on the AWS bill — budget them separately or the business case is wrong
