This article will tell you the differences between AWS Direct Connect and Site-to-Site VPN, but before we begin.
What is AWS Direct Connect?
AWS Direct Connect, as its name implies, is a dedicated line between your local IT infrastructure (i.e. your on-premises data center) and your AWS Cloud. The private nature of the connection, combined with the fact that it bypasses the public internet, allows the user to enjoy reduced congestion as well as lower network unpredictability.
What is AWS Site-to-Site VPN?
Unlike Direct Connect, AWS Site-to-Site VPN does use the public internet; however, it ensures security by creating an encrypted connection between Amazon VPC and your on-premises/private IT infrastructure. In effect, VPN connections extend your on-premises networks to your VPC, such that it feels like they are running in your infrastructure.
Key differences between AWS Direct Connect and Site-to-Site VPN
The main points of difference come from the fact that one (AWS Direct Connect) uses the public internet and the other does not. This allows AWS Direct Connect users to enjoy high bandwidth and security by default. AWS Site-to-Site VPN, on the other hand, offers security through encryption by default; however, as it runs over the public internet network fluctuations result in an inconsistent experience.
Performance
AWS VPN performance taps out at 4 GBPS, a fraction of that achieved by Direct Connect, which starts at 50 MBPS and can reach 100 Gbps
AWS Direct Connect also provides a consistent experience as the network is steady, as compared to AWS VPN where bandwidth and latency fluctuate according to the traffic experienced on the public internet.
Pricing
AWS VPN doesn’t call for extensive additional hardware, unlike Direct Connect, and thus enjoys a lower price point. In addition, VPN offers optional by-the-connection-hour pricing, which obviously is not possible with AWS Direct Connect.
Security & Availability
Being a private connection, AWS Direct Connect doesn’t offer encryption of transit traffic by default. However, AWS VPN operates over the public network and this brings potential security risks. For this reason, VPN provides the option of encryption of your traffic. AWS VPN also provides redundancy through a second channel. So, should the primary channel fail for any reason, your data will still be accessible through the second channel. This feature is not available on Direct Connect. But, if required, it can be set up—as long as the user’s data safety regulations allow for it.
Installation Time
AWS VPN is ideal for organizations that are new to the AWS cloud and are still finding their feet. AWS VPN is easy and quick to set up, and, as we saw, lighter on the pocket too. However, if you need higher security and stable, consistent network performance, AWS Direct Connect is the solution for you. Installation takes longer and needs the expertise of an experienced team to set up, but the performance is worth the wait.
AWS VPN vs Direct Connect
| AWS VPN | AWS Direct Connect |
|---|---|
| Encrypted connectivity (IPSec) | Connection not encrypted |
| Latency not assured | Low latency |
| Unpredictable network experience, as it operates over the public internet | Consistent network experience as it doesn’t use the public internet |
| Low scalability—limited to 1.2 Gbps bandwidth | High Scalability—up to 100 Gbps, thanks to dedicated connection |
| Quick and easy to set up | Installation requires an experienced team |
| Port costs are at USD0.05/connection hour with USD0.09/GB for data transfer out (DTO) |
Costs range from USD0.02 to USD0.19/GB of data transfer out Port feet per hour are based on port speed. |
AWS Site-to-Site VPN and Direct Connect—Pros & Cons
Businesses seeking secure connectivity with ultra-low latency and high bandwidth would do well to opt for AWS Direct Connect. And although it may seem pricier at the outset, what with installation costs, once the connection is established, you will save on data transfer costs thanks to the high and consistent network performance.
AWS Site-to-Site VPN is an excellent choice for businesses new to AWS, as it is fast and relatively easy to set up. But bear in mind that AWS VPN runs over the public Internet, which means bandwidth and, thus, performance is unpredictable. Also, as it runs on the public internet, there are valid security concerns.
Integrating AWS Site-to-Site VPN with Direct Connect
For a best-of-both-worlds option, users can combine AWS Direct Connect with AWS Site-to-Site VPN. This solution gives users the security of AWS VPN’s end-to-end IPSec connection. The secure encryption of data flowing through the network combined with the low latency and better bandwidth of AWS Direct Connect creates a much more consistent network experience than internet-based VPN connections.
Another advantage of combining AWS Direct Connect and AWS Site-to-Site VPN is that users can achieve high availability and resiliency of their network by leveraging the benefits of AWS Direct Connect connections for their primary connectivity to AWS. This can be done by establishing AWS Direct Connect connections with an AWS VPN backup. Needless to say, your AWS VPN connection should be able to handle the failover traffic from AWS Direct Connect.
Takeaways
As organizations continue to migrate to the cloud, connectivity between their on-premises infrastructure and AWS cloud is of critical importance. AWS offers two excellent—and distinctively different—solutions for this: AWS Direct Connect and AWS VPN.
While Direct Connect offers
A more predictable network experience, allowing you to access your AWS resources with greater bandwidth and lower network costs. However, for businesses that are just starting out on AWS, AWS Site-to-Site VPN offers a quick and easy way to connect and secure your network.
If you’re still unsure about which solution works best for you, reach out to Teleglobal. As independent Managed Service Providers, and partners to AWS, Azure, and Google Cloud, we have the necessary skills, tools, and experience to help you get on the cloud, and make the most of its benefits.
