Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
A private network connection from your premises into AWS through a Direct Connect location, reaching your VPCs and AWS services without crossing the internet.
Where Direct Connect takes you5 steps, all open
Direct Connect links your network to a Direct Connect location over a standard Ethernet fibre-optic cable, one end on your router and the other on an AWS router. Over it you create virtual interfaces to your VPCs or to public AWS services such as S3, bypassing internet service providers along the way.
Private, not secret. The traffic stays off the internet, but Direct Connect does not encrypt it by default. MACsec on a dedicated connection, or a Site-to-Site VPN run over the connection, adds encryption.
A private road from your warehouse to a port. It is yours alone, so lorries move at the same speed every day, unlike on the public motorway. Gates at the port lead to different docks: one to your own sheds there, one to the port's public services. The road has no walls, though: anyone at the roadside could look in unless you seal the lorries.
ConnectionDirect Connect locationPrivate virtual interfacePublic virtual interfaceTransit virtual interfaceMACsec or VPNIs it the right kind? A private interface reaches addresses inside VPCs, a public one AWS public services, a transit one transit gateways.
A private interface on a virtual private gateway reaches one VPC in its Region; through a Direct Connect gateway it reaches VPCs in any Region.
Is a connection up, with its BGP session advertising the routes?
Does the traffic need encrypting? Direct Connect alone does not do it.
Pick a case to follow the traffic through each check.
Two locations, not just two cables. Maximum resiliency puts separate connections on separate devices in more than one location, for a 99.99% SLA; high resiliency puts connections at multiple locations, for 99.9%.
A VPN in reserve. For the same prefix, a virtual private gateway prefers routes learned from Direct Connect, so the VPN carries traffic only once those routes are gone.
Test the failover. The failover test brings a BGP session down on purpose, to show traffic moving to a redundant virtual interface.
Not encrypted by default. Direct Connect keeps traffic off the internet, but does not encrypt it.
MACsec encrypts at layer 2 between your router and the Direct Connect device, on 10, 100 and 400 Gbps dedicated connections at selected locations; hosted connections cannot use it.
A VPN over Direct Connect puts an IPsec tunnel on the private line, for encryption end to end.
BGP is authenticated with MD5, which AWS turns on and you cannot turn off.
Port hours, by capacity and by whether the connection is dedicated or hosted, whether or not any data flows.
Data transfer out through the connection, generally at lower rates than over the internet; data transfer in is not charged.
Billing starts when the port is active, or 90 days after the LOA-CFA is issued, whichever comes first.
Partners may charge separately for their circuits and services.
Prices change, so none are printed here. Check the Direct Connect pricing page on aws.amazon.com.
| Link | Path | Encryption | Bandwidth | Choose it when |
|---|---|---|---|---|
| Direct Connect | A private line through a Direct Connect location | Not by default; MACsec or a VPN on top | 50 Mbps to 400 Gbps | Consistent performance and heavy transfers |
| Site-to-Site VPN | IPsec tunnels over the internet | Always | Up to 1.25 Gbps a standard tunnel | Encryption over the internet link you have |
| Virtual interface | Reaches | Through |
|---|---|---|
| Private | One VPC, or many in any Region | A virtual private gateway, or a Direct Connect gateway |
| Public | All AWS public services, by public address | The connection itself |
| Transit | Transit gateways, across Regions | A Direct Connect gateway |
| Resiliency model | How the connections are placed | Suits |
|---|---|---|
| Maximum | Separate devices, in more than one location | Critical workloads, 99.99% SLA |
| High | Connections at multiple locations | Critical workloads, 99.9% SLA |
| Development and test | Separate devices, in one location | Workloads that are not critical |
consistent network performance between the data centre and AWSDirect Connect
A private line avoids the variations of paths across the internet.
encrypt traffic over Direct ConnectMACsec, or a VPN over it
Direct Connect on its own does not encrypt.
reach VPCs in several Regions over one connectionA Direct Connect gateway
It is global, and reaches VPCs in any Region except China.
reach S3's public endpoints over Direct ConnectA public virtual interface
A private interface reaches only addresses inside VPCs.
connect to many VPCs attached to transit gatewaysA transit virtual interface
It reaches transit gateways through a Direct Connect gateway.
the highest resiliency for critical workloadsMaximum resiliency
Separate connections on separate devices, in more than one location.
a backup path over the internet if the connection failsA Site-to-Site VPN
A virtual private gateway prefers Direct Connect routes, so the VPN waits in reserve.
treat several connections as oneA link aggregation group
Up to 4 connections of the same speed at the same endpoint, all active.
500 Mbps without a whole dedicated portA hosted connection
Partners offer them from 50 Mbps to 25 Gbps.
let VPCs talk to each other through the Direct Connect gatewayNot what it does
Associations on one Direct Connect gateway do not send traffic to each other; use a transit gateway.
A manufacturer moves terabytes between its data centre and a VPC every night, and transfers over its internet VPN are erratic. The new link must keep working if a whole Direct Connect location fails, and the traffic must be encrypted. What should a solutions architect design?
A data centre must reach apps in VPCs attached to a transit gateway over a private, dedicated 10 Gbps link that never crosses the internet and performs the same every day. What carries the traffic from the data centre?
1, 10, 100 or 400 Gbps; hosted from 50 Mbps.99.99%.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.