AWS Site-to-Site VPN

Managed IPsec tunnels connecting an on-premises network to a VPC over the public internet.

Verified against AWS documentation · 2026-08-24

Key facts

01Two halves: a customer gateway (your on-prem device) and a virtual private gateway (one VPC) or transit gateway (many VPCs)
02Every connection ships two tunnels in two AZs — AWS-to-on-prem prefers one; true active/active needs transit gateway + ECMP
03Static routes or BGP — BGP gives automatic failover; static means someone edits a route table during an outage
04Limits: 1.25 Gbps per tunnel standard, 5 Gbps with Large Bandwidth Tunnels (transit gateway or Cloud WAN only), ~140,000 pps per tunnel

Phrases and scenarios that point here.

"Encrypted", "IPsec", "over the internet", "data center to VPC"
"Needed within hours" or "temporary" hybrid link → VPN; Direct Connect has weeks-to-months lead time
Backup or failover path for Direct Connect → Site-to-Site VPN as the secondary
Many branch offices reaching many VPCs → VPN onto a transit gateway, not one VGW per VPC

Dedicated circuit, predictable latency, traffic never touching the internet → Direct Connect
Individual remote employees on laptops → AWS Client VPN
VPC-to-VPC connectivity inside AWS → VPC peering or Transit Gateway

01Standby path for Direct Connect — the VPN sits configured and idle, and BGP moves traffic onto it the moment the circuit drops, with no one paged
02Branch and edge sites too small to justify a cross-connect — retail stores, clinics, factory floors — each terminating on one shared transit gateway
03Migration bridge, where on-prem app servers keep talking to a database replicating into RDS across the tunnel until cutover, then the VPN is deleted
04Vendor or partner access into a private subnet when the vendor's appliance only speaks IPsec and nothing should be exposed publicly
05Pilot-light DR, where a standby VPC carries only replication traffic and the tunnel is cheap enough to leave running year-round

01Billed per VPN connection-hour from creation to deletion — an idle standby VPN costs the same as a saturated one
02Both tunnels are included in that single hourly rate, so there is no cost argument for running a single-tunnel design
03Inbound data is free; data leaving over the tunnel is billed at standard internet data transfer rates
04Failing over from Direct Connect to VPN silently re-prices egress from DX rates to internet rates — a long outage shows up on the bill, not just the dashboard
05Terminating on a transit gateway adds attachment-hours plus per-GB processing; Accelerated VPN adds Global Accelerator charges on top