Learn
AWS
Networking & content delivery
Site-to-Site VPN

AWSGCP laterAzure later

Site-to-Site VPNAWS Site-to-Site VPN

Networking & content deliveryCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

Encrypted IPsec tunnels over the internet between your own network and your VPCs, two to a connection, ending on a virtual private gateway or a transit gateway.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalHIGHSysOps Administrator – AssociateMEDSecurity – SpecialtyMED

Where Site-to-Site VPN takes you5 steps, all open

I know the problem it solves
I can picture it
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

Your network, joined to a VPC

By default, nothing in a VPC can talk to your own network. A Site-to-Site VPN connection joins them with IPsec tunnels across the internet, between a customer gateway device on your side and a virtual private gateway or a transit gateway on AWS's.

Two tunnels every time. Each connection has two tunnels, each with its own public address and ending in a different Availability Zone. Configure both: when one is down for maintenance, traffic moves to the other by itself.

Reach for it when

an office or data centre needs encrypted access to a VPC over its internet link
Direct Connect needs a backup path
several branch offices should reach each other through AWS
traffic on Direct Connect must be encrypted

It is the wrong tool when

performance must be the same every day: Direct Connect stays off the internet
one tunnel must carry more than 5 Gbps: spread across tunnels with ECMP on a transit gateway, or use Direct Connect

Mental model

Armoured vans on public roads

Armoured vans between two bank branches, on public roads. Anyone can see a van, but nobody can see inside, and there are always two vans on two different routes, so if one breaks down the money still arrives. Each branch needs a loading dock for them to back into.

The armoured vanencrypted traffic across the internetIPsec tunnel

Two vans, two routesredundancy across zonesTwo tunnels

Your branch's loading dockthe device on your sideCustomer gateway device

AWS's dock for one buildingthe endpoint attached to one VPCVirtual private gateway

AWS's depot for many buildingsthe endpoint shared by many VPCsTransit gateway

Drivers telling each other the roadsroutes exchanged automaticallyBGP

How it works

Two gateways, two tunnels, a route

Describe your sideA customer gateway tells AWS about your device: its public address and, for BGP, its ASN.
Choose AWS's sideA virtual private gateway for one VPC, or a transit gateway for many.
Create the connectionChoose static routes or BGP, then download a configuration file for your device, with both tunnels in it.
Route to itAdd routes, or turn on route propagation, so the VPC sends traffic for your network to the gateway.

Tunnels: Two per connectioneach in a different AZ
Standard tunnel: Up to 1.25 Gbpsand 140,000 packets a second
Large Bandwidth Tunnel: Up to 5 Gbpstransit gateway or Cloud WAN only
Routing: Static or BGPBGP when the device supports it
Per virtual private gateway: 10 connectionsby default; can be raised
MTU: 1,446 bytesno jumbo frames

Route table
Does the subnet's route table send traffic for your network to the virtual private gateway, by a static route or by route propagation?
A tunnel up
Is at least one of the two tunnels up, and set up on your device?
Bandwidth
Does the traffic fit? A standard tunnel carries up to 1.25 Gbps, and a virtual private gateway uses one tunnel at a time.
Your device
Does your customer gateway device route traffic for the VPC back into the connection?

Pick a case to follow the packet through each check.

Architecture

Offices into a hub

Each office's VPN connection ends on the transit gateway, which routes it to both VPCs; the tunnels report their state to CloudWatch.

A transit gateway for many VPCs. A virtual private gateway attaches to one VPC; to reach several over the same connection, AWS recommends a transit gateway.

More bandwidth on a transit gateway. ECMP spreads traffic across tunnels, and needs BGP; Large Bandwidth Tunnels carry up to 5 Gbps each.

Branches through the hub. With VPN CloudHub on a virtual private gateway, sites with unique BGP ASNs and ranges that do not overlap reach one another as well as the VPC.

Enter at the edge. An accelerated VPN, on a transit gateway only, reaches AWS at the edge location nearest your device, through Global Accelerator.

Security

Strong tunnels, clean ranges

IPsec encryption, with options that include AES 256-bit encryption, SHA-2 hashing and more Diffie-Hellman groups.

Tunnel options. AWS supplies default values, and you can restrict the list of options the AWS tunnel endpoints will accept.

Certificate authentication, using a private certificate from AWS Private Certificate Authority.

Keep ranges apart. Give the VPCs and your own network CIDR blocks that do not overlap.

Cost

How you are charged, not what it costs today

Per VPN connection-hour, while the connection is provisioned and available.

Data transfer out from AWS, at the standard rates.

An accelerated VPN adds charges for the two accelerators AWS creates for it.

A transit gateway attachment is charged by the hour, separately.

CloudHub costs the usual connection rates, plus data sent from the gateway out to a site.

Prices change, so none are printed here. Check the VPN pricing page on aws.amazon.com.

Comparison

Tunnel or line, and which gateway

Link	Path	Encryption	Bandwidth	Choose it when
Site-to-Site VPN	IPsec tunnels across the internet	Always on	1.25 Gbps a standard tunnel	Encrypted links over internet you already have
Direct Connect	A private line via a Direct Connect location	Only with MACsec or a VPN on top	50 Mbps hosted, up to 400 Gbps dedicated	Steady performance for heavy traffic

AWS side	Reaches	Allows
Virtual private gateway	One VPC	CloudHub between sites; one tunnel in use at a time
Transit gateway	Many VPCs	ECMP, Large Bandwidth Tunnels, accelerated VPN

Route to the same prefix, on a virtual private gateway	Preference
BGP routes from Direct Connect	First
Static routes on a VPN connection	Second
BGP routes from a VPN connection	Third

SAA traps

The phrase in the question, and what it means

encrypted connectivity to the VPC over the existing internet connectionSite-to-Site VPN

IPsec tunnels across the internet to a virtual private gateway or a transit gateway.

the VPN must survive a problem in one AWS Availability ZoneConfigure both tunnels

Each ends in a different AZ, and traffic moves to the one that is up.

more than 1.25 Gbps over VPNA transit gateway with ECMP, or Large Bandwidth Tunnels

A virtual private gateway uses one tunnel at a time.

branch offices must talk to each other through AWSVPN CloudHub

One virtual private gateway, unique BGP ASNs, ranges that do not overlap.

a backup for Direct ConnectSite-to-Site VPN

For the same prefix, Direct Connect routes win, so the VPN carries traffic only when they are gone.

fail over to the second tunnel more reliablyDynamic routing with BGP

AWS recommends it for its liveness detection checks.

fewer internet disruptions on the VPN pathAccelerated VPN

Traffic enters AWS at the nearest edge location; transit gateways only.

one VPN connection to reach many VPCsA transit gateway

A virtual private gateway attaches to a single VPC.

encrypt the traffic that already runs over Direct ConnectA VPN over Direct Connect

An IPsec tunnel on top of the private line.

a static route and a propagated VPN route for the same rangeThe static route wins

Where the prefixes are equal, static routes are preferred over propagated ones.

Scenario

Exam style, marked when you answer

A company's head office must reach a VPC with its traffic encrypted, using the office's existing internet connection. It needs no more than 1 Gbps, and the link must keep working while one AWS tunnel endpoint is down for maintenance. What should a solutions architect set up?

Practice

Fill the gap, the way the challenges work

A branch office must reach apps in three VPCs attached to a transit gateway, over its existing internet connection, with all of the traffic encrypted. What connects the branch to the hub?

Pick a service belowTransit Gateway· Hub for three VPCsEC2· Apps in the VPCs

Quick revision

The night before the exam

What: IPsec tunnels over the internet into your VPCs.
Tunnels: Two per connection, in different AZs; configure both.
Bandwidth: 1.25 Gbps a standard tunnel, 5 Gbps a large one.
AWS side: Virtual private gateway for one VPC, transit gateway for many.
Routing: BGP recommended; static if the device cannot do BGP.
Priority: Direct Connect, then static VPN, then BGP VPN.
CloudHub: Sites reach each other through one gateway.
Accelerated: Enters at the nearest edge; transit gateway only.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.