Learn
AWS
Networking & content delivery
Direct Connect

AWSGCP laterAzure later

Direct ConnectAWS Direct Connect

Networking & content deliveryCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

A private network connection from your premises into AWS through a Direct Connect location, reaching your VPCs and AWS services without crossing the internet.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalHIGHSysOps Administrator – AssociateMEDSecurity – SpecialtyLOW

Where Direct Connect takes you5 steps, all open

I know the problem it solves
I can picture it
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

A private line into AWS

Direct Connect links your network to a Direct Connect location over a standard Ethernet fibre-optic cable, one end on your router and the other on an AWS router. Over it you create virtual interfaces to your VPCs or to public AWS services such as S3, bypassing internet service providers along the way.

Private, not secret. The traffic stays off the internet, but Direct Connect does not encrypt it by default. MACsec on a dedicated connection, or a Site-to-Site VPN run over the connection, adds encryption.

Reach for it when

large, steady transfers run between a data centre and AWS
network performance must be consistent, not at the mercy of the internet
the data centre must reach VPCs in several Regions
outbound data transfer should cost less than it does over the internet

It is the wrong tool when

an encrypted link is needed over the internet connection you already have: that is Site-to-Site VPN
VPCs must route traffic to one another: that is a transit gateway

Mental model

A private road to the port

A private road from your warehouse to a port. It is yours alone, so lorries move at the same speed every day, unlike on the public motorway. Gates at the port lead to different docks: one to your own sheds there, one to the port's public services. The road has no walls, though: anyone at the roadside could look in unless you seal the lorries.

The private roada dedicated or hosted network linkConnection

Where the road meets the portwhere your line meets an AWS routerDirect Connect location

The gate to your own shedsaccess to a VPC by private addressPrivate virtual interface

The gate to the port's servicesAWS public services such as S3Public virtual interface

The gate to the port's hubtransit gateways, in several RegionsTransit virtual interface

Sealing the lorriesencryption added on topMACsec or VPN

How it works

Order, cross-connect, interface, route

Order a connectionA dedicated port of 1, 10, 100 or 400 Gbps from AWS, or a hosted connection from 50 Mbps to 25 Gbps through a partner.
Cross-connect at the locationAWS issues a Letter of Authorization (LOA-CFA), which your provider uses to connect your line to AWS's router.
Create virtual interfacesPrivate for a VPC, public for AWS public services, transit for transit gateways; each one runs BGP.
Reach further with a gatewayA Direct Connect gateway connects an interface to VPCs in any Region except the China Regions.

Dedicated ports: 1 to 400 Gbps1, 10, 100 or 400; fixed once ordered
Hosted connections: 50 Mbps to 25 Gbpsthrough a partner
Port request: Up to 72 business hoursfor AWS to review and provision
Encryption: Off by defaultMACsec or a VPN adds it
Maximum resiliency: 99.99% SLAconnections at more than one location
LAG: Up to 4 connections2 at 100 or 400 Gbps; same speed, same endpoint

Virtual interface
Is it the right kind? A private interface reaches addresses inside VPCs, a public one AWS public services, a transit one transit gateways.
Gateway
A private interface on a virtual private gateway reaches one VPC in its Region; through a Direct Connect gateway it reaches VPCs in any Region.
The connection
Is a connection up, with its BGP session advertising the routes?
Encryption
Does the traffic need encrypting? Direct Connect alone does not do it.

Pick a case to follow the traffic through each check.

Architecture

A line into AWS, with a spare

The data centre, off to the left, reaches its VPC over a private interface and S3 over a public one; a VPN waits for the day the line fails.

Two locations, not just two cables. Maximum resiliency puts separate connections on separate devices in more than one location, for a 99.99% SLA; high resiliency puts connections at multiple locations, for 99.9%.

A VPN in reserve. For the same prefix, a virtual private gateway prefers routes learned from Direct Connect, so the VPN carries traffic only once those routes are gone.

Test the failover. The failover test brings a BGP session down on purpose, to show traffic moving to a redundant virtual interface.

Security

Private is not encrypted

Not encrypted by default. Direct Connect keeps traffic off the internet, but does not encrypt it.

MACsec encrypts at layer 2 between your router and the Direct Connect device, on 10, 100 and 400 Gbps dedicated connections at selected locations; hosted connections cannot use it.

A VPN over Direct Connect puts an IPsec tunnel on the private line, for encryption end to end.

BGP is authenticated with MD5, which AWS turns on and you cannot turn off.

Cost

How you are charged, not what it costs today

Port hours, by capacity and by whether the connection is dedicated or hosted, whether or not any data flows.

Data transfer out through the connection, generally at lower rates than over the internet; data transfer in is not charged.

Billing starts when the port is active, or 90 days after the LOA-CFA is issued, whichever comes first.

Partners may charge separately for their circuits and services.

Prices change, so none are printed here. Check the Direct Connect pricing page on aws.amazon.com.

Comparison

Line or tunnel, interface, resiliency

Link	Path	Encryption	Bandwidth	Choose it when
Direct Connect	A private line through a Direct Connect location	Not by default; MACsec or a VPN on top	50 Mbps to 400 Gbps	Consistent performance and heavy transfers
Site-to-Site VPN	IPsec tunnels over the internet	Always	Up to 1.25 Gbps a standard tunnel	Encryption over the internet link you have

Virtual interface	Reaches	Through
Private	One VPC, or many in any Region	A virtual private gateway, or a Direct Connect gateway
Public	All AWS public services, by public address	The connection itself
Transit	Transit gateways, across Regions	A Direct Connect gateway

Resiliency model	How the connections are placed	Suits
Maximum	Separate devices, in more than one location	Critical workloads, 99.99% SLA
High	Connections at multiple locations	Critical workloads, 99.9% SLA
Development and test	Separate devices, in one location	Workloads that are not critical

SAA traps

The phrase in the question, and what it means

consistent network performance between the data centre and AWSDirect Connect

A private line avoids the variations of paths across the internet.

encrypt traffic over Direct ConnectMACsec, or a VPN over it

Direct Connect on its own does not encrypt.

reach VPCs in several Regions over one connectionA Direct Connect gateway

It is global, and reaches VPCs in any Region except China.

reach S3's public endpoints over Direct ConnectA public virtual interface

A private interface reaches only addresses inside VPCs.

connect to many VPCs attached to transit gatewaysA transit virtual interface

It reaches transit gateways through a Direct Connect gateway.

the highest resiliency for critical workloadsMaximum resiliency

Separate connections on separate devices, in more than one location.

a backup path over the internet if the connection failsA Site-to-Site VPN

A virtual private gateway prefers Direct Connect routes, so the VPN waits in reserve.

treat several connections as oneA link aggregation group

Up to 4 connections of the same speed at the same endpoint, all active.

500 Mbps without a whole dedicated portA hosted connection

Partners offer them from 50 Mbps to 25 Gbps.

let VPCs talk to each other through the Direct Connect gatewayNot what it does

Associations on one Direct Connect gateway do not send traffic to each other; use a transit gateway.

Scenario

Exam style, marked when you answer

A manufacturer moves terabytes between its data centre and a VPC every night, and transfers over its internet VPN are erratic. The new link must keep working if a whole Direct Connect location fails, and the traffic must be encrypted. What should a solutions architect design?

Practice

Fill the gap, the way the challenges work

A data centre must reach apps in VPCs attached to a transit gateway over a private, dedicated 10 Gbps link that never crosses the internet and performs the same every day. What carries the traffic from the data centre?

Pick a service belowTransit Gateway· Hub for the VPCsEC2· Apps in the VPCs

Quick revision

The night before the exam

What: A private line into AWS through a Direct Connect location.
Speeds: Dedicated 1, 10, 100 or 400 Gbps; hosted from 50 Mbps.
Interfaces: Private to VPCs, public to AWS services, transit to transit gateways.
DX gateway: Global: VPCs in any Region except China.
Encryption: None by default; MACsec, or a VPN over the line.
Resiliency: Separate devices in more than one location for 99.99%.
Routing: BGP; preferred over VPN routes for the same prefix.
Billing: Port hours plus data out; data in is free.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.