Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Encrypted IPsec tunnels over the internet between your own network and your VPCs, two to a connection, ending on a virtual private gateway or a transit gateway.
Where Site-to-Site VPN takes you5 steps, all open
By default, nothing in a VPC can talk to your own network. A Site-to-Site VPN connection joins them with IPsec tunnels across the internet, between a customer gateway device on your side and a virtual private gateway or a transit gateway on AWS's.
Two tunnels every time. Each connection has two tunnels, each with its own public address and ending in a different Availability Zone. Configure both: when one is down for maintenance, traffic moves to the other by itself.
Armoured vans between two bank branches, on public roads. Anyone can see a van, but nobody can see inside, and there are always two vans on two different routes, so if one breaks down the money still arrives. Each branch needs a loading dock for them to back into.
IPsec tunnelTwo tunnelsCustomer gateway deviceVirtual private gatewayTransit gatewayBGPDoes the subnet's route table send traffic for your network to the virtual private gateway, by a static route or by route propagation?
Is at least one of the two tunnels up, and set up on your device?
Does the traffic fit? A standard tunnel carries up to 1.25 Gbps, and a virtual private gateway uses one tunnel at a time.
Does your customer gateway device route traffic for the VPC back into the connection?
Pick a case to follow the packet through each check.
A transit gateway for many VPCs. A virtual private gateway attaches to one VPC; to reach several over the same connection, AWS recommends a transit gateway.
More bandwidth on a transit gateway. ECMP spreads traffic across tunnels, and needs BGP; Large Bandwidth Tunnels carry up to 5 Gbps each.
Branches through the hub. With VPN CloudHub on a virtual private gateway, sites with unique BGP ASNs and ranges that do not overlap reach one another as well as the VPC.
Enter at the edge. An accelerated VPN, on a transit gateway only, reaches AWS at the edge location nearest your device, through Global Accelerator.
IPsec encryption, with options that include AES 256-bit encryption, SHA-2 hashing and more Diffie-Hellman groups.
Tunnel options. AWS supplies default values, and you can restrict the list of options the AWS tunnel endpoints will accept.
Certificate authentication, using a private certificate from AWS Private Certificate Authority.
Keep ranges apart. Give the VPCs and your own network CIDR blocks that do not overlap.
Per VPN connection-hour, while the connection is provisioned and available.
Data transfer out from AWS, at the standard rates.
An accelerated VPN adds charges for the two accelerators AWS creates for it.
A transit gateway attachment is charged by the hour, separately.
CloudHub costs the usual connection rates, plus data sent from the gateway out to a site.
Prices change, so none are printed here. Check the VPN pricing page on aws.amazon.com.
| Link | Path | Encryption | Bandwidth | Choose it when |
|---|---|---|---|---|
| Site-to-Site VPN | IPsec tunnels across the internet | Always on | 1.25 Gbps a standard tunnel | Encrypted links over internet you already have |
| Direct Connect | A private line via a Direct Connect location | Only with MACsec or a VPN on top | 50 Mbps hosted, up to 400 Gbps dedicated | Steady performance for heavy traffic |
| AWS side | Reaches | Allows |
|---|---|---|
| Virtual private gateway | One VPC | CloudHub between sites; one tunnel in use at a time |
| Transit gateway | Many VPCs | ECMP, Large Bandwidth Tunnels, accelerated VPN |
| Route to the same prefix, on a virtual private gateway | Preference |
|---|---|
| BGP routes from Direct Connect | First |
| Static routes on a VPN connection | Second |
| BGP routes from a VPN connection | Third |
encrypted connectivity to the VPC over the existing internet connectionSite-to-Site VPN
IPsec tunnels across the internet to a virtual private gateway or a transit gateway.
the VPN must survive a problem in one AWS Availability ZoneConfigure both tunnels
Each ends in a different AZ, and traffic moves to the one that is up.
more than 1.25 Gbps over VPNA transit gateway with ECMP, or Large Bandwidth Tunnels
A virtual private gateway uses one tunnel at a time.
branch offices must talk to each other through AWSVPN CloudHub
One virtual private gateway, unique BGP ASNs, ranges that do not overlap.
a backup for Direct ConnectSite-to-Site VPN
For the same prefix, Direct Connect routes win, so the VPN carries traffic only when they are gone.
fail over to the second tunnel more reliablyDynamic routing with BGP
AWS recommends it for its liveness detection checks.
fewer internet disruptions on the VPN pathAccelerated VPN
Traffic enters AWS at the nearest edge location; transit gateways only.
one VPN connection to reach many VPCsA transit gateway
A virtual private gateway attaches to a single VPC.
encrypt the traffic that already runs over Direct ConnectA VPN over Direct Connect
An IPsec tunnel on top of the private line.
a static route and a propagated VPN route for the same rangeThe static route wins
Where the prefixes are equal, static routes are preferred over propagated ones.
A company's head office must reach a VPC with its traffic encrypted, using the office's existing internet connection. It needs no more than 1 Gbps, and the link must keep working while one AWS tunnel endpoint is down for maintenance. What should a solutions architect set up?
A branch office must reach apps in three VPCs attached to a transit gateway, over its existing internet connection, with all of the traffic encrypted. What connects the branch to the hub?
1.25 Gbps a standard tunnel, 5 Gbps a large one.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.