How can Direct Connect and Site to Site VPN be combined to provide a highly available hybrid connectivity design?

Intermediate

Answer

A common resilient design uses a primary Direct Connect connection for its consistent performance, paired with a Site to Site VPN configured as an automatic failover path, so if the Direct Connect connection ever experiences an outage, traffic automatically fails over to the VPN connection over the public internet, ensuring hybrid connectivity remains available even though performance temporarily decreases during the failover period.

aws ec2 create-vpn-connection --type ipsec.1 --customer-gateway-id cgw-12345678 --vpn-gateway-id vgw-12345678 --options '{"StaticRoutesOnly":false}'

Real-world example A financial institution relies on Direct Connect as its primary hybrid connection but configures a Site to Site VPN as an automatic backup, ensuring trading applications remain connected to on premises systems even during a rare Direct Connect outage.

Common follow-ups: How does BGP routing help manage automatic failover between Direct Connect and VPN?;What performance difference should be expected when failing over to VPN?

AWS Backup & Disaster Recovery;VPC & Networking

All 7 AWS Direct Connect & Hybrid Connectivity questions