AWS Direct Connect

AWS Direct Connect provides dedicated network connections between on-premises networks and AWS by provisioning physical or partner-hosted links at AWS Direct Connect locations and exposing virtual interfaces. It operates as a network edge service that establishes private or public virtual interfaces for connectivity to Amazon VPCs or AWS public endpoints. It fits into architectures where predictable bandwidth, consistent network performance, or private connectivity are required between customer datacentres and AWS.

🗂 Resource Category

Networking and Content Delivery • Migration and Transfer

🧠 Exam Memory Hook

Think: "Dedicated on-premises to AWS network + predictable bandwidth + VPC connectivity = AWS Direct Connect"

📖 Ownership

Classification: Shared Responsibility Service

AWS responsibilities: AWS operates and secures the Direct Connect locations and the AWS-owned physical infrastructure, including the switches, optical equipment, and the Direct Connect control plane; AWS maintains and patches the AWS-managed network devices and the service platform that presents physical ports and virtual interface configuration. AWS also manages the Direct Connect API, console, and the integration points to AWS Regions and Direct Connect Gateway. AWS does not operate or patch customer on-premises routers, colocation provider cross-connects that are customer-controlled, or customer-managed network appliances.

Customer responsibilities: The customer procures or arranges the physical cross-connect (directly or via a partner), configures on-premises routers and VLANs, creates and configures virtual interfaces and BGP routing, enforces encryption if required, and implements redundancy and monitoring; the customer also secures, monitors, and patches their on-premises network devices and any network virtual appliances they deploy in AWS. If using a hosted connection from a Direct Connect Partner, the customer coordinates ordering, VLAN tagging, and routing with the partner and configures AWS-side virtual interfaces and routing policies.

Patching responsibilities: AWS patches and maintains the physical infrastructure it owns (facility equipment, switches, and the Direct Connect service platform). Patching of on-premises physical infrastructure, router operating systems, network appliance firmware, and customer-deployed virtual appliances and software is the customer's responsibility. Hypervisor and guest operating system patching are not applicable to the Direct Connect service itself; application libraries, runtimes, and customer applications remain the customer's responsibility.

🏗 Typical Architecture

💡 Top 5 Features

Provides dedicated physical network connections from customer premises to AWS at Direct Connect locations.
Supports private and public virtual interfaces to access Amazon VPC resources or AWS public endpoints respectively.
Allows partner-hosted (hosted) connections through AWS Direct Connect Partners when colocation is not used.
Supports Link Aggregation Groups (LAG) to combine multiple connections into a single logical interface for increased bandwidth and redundancy.
Integrates with Direct Connect Gateway and AWS Transit Gateway to route traffic to multiple VPCs and accounts.

✅ Top 5 Use Cases

Establish private VPC connectivity for production applications that require predictable network performance and separation from the public internet.
Move large volumes of data between on-premises storage and AWS for backup, archive, or data-processing workflows using high-throughput links.
Implement hybrid architectures where on-premises services and AWS-hosted services exchange traffic over BGP-routed private links.
Connect multiple AWS accounts and VPCs via Direct Connect Gateway and Transit Gateway to centralise network egress and management.
Replace or supplement internet VPNs when lower variability and consistent capacity are required for compliance or operational reasons.

🏗 Architecture Placement

AWS Direct Connect sits at the network edge and provides a private network link between customer on-premises routers and AWS Regions; on-premises routers send traffic to a Direct Connect port (physical or partner-hosted), which then terminates into AWS and is presented as virtual interfaces that connect to Amazon VPCs or AWS public endpoints. It commonly integrates with Direct Connect Gateway or AWS Transit Gateway to route traffic to multiple VPCs and accounts, and is configured and consumed at the account and regional level depending on gateway selection.

🎯 Commonly Used With

- Amazon VPC
- AWS Transit Gateway
- AWS Site-to-Site VPN
- Amazon CloudWatch
- AWS Identity and Access Management

🌍 5 Real-World Examples

A bank connects its primary datacentre to Amazon VPCs over Direct Connect to isolate transaction traffic from the public internet and maintain stable throughput for core banking systems.
A media production company transfers large raw video assets from on-premises storage to AWS for batch processing using a high-throughput Direct Connect link to reduce variability compared to internet transfers.
A healthcare provider replicates backup datasets to AWS over Direct Connect to meet network segregation and predictable bandwidth requirements for nightly backups.
A retail company centralises store analytics by routing POS data from regional datacentres into VPC-based analytics clusters via Direct Connect and Transit Gateway for consistent ingestion.
A telecommunications operator connects edge aggregation sites to AWS-hosted network functions over Direct Connect to maintain deterministic routing and capacity planning.

🎓 AWS Exam Clues

Use Direct Connect when the requirement specifies private, dedicated connectivity with predictable bandwidth or separation from the public internet.
Combine Direct Connect Gateway with Transit Gateway when you need to connect a Direct Connect connection to multiple VPCs across accounts.
Direct Connect does not provide encryption of traffic by default; plan additional encryption if required for compliance or security.
Hosted connections from Direct Connect Partners are used when the customer cannot colocate at an AWS Direct Connect location or needs flexible port provisioning.
Architect for redundancy with multiple Direct Connect connections or redundant paths because a single physical port is a single point of failure.

📝 Quick Revision

AWS Direct Connect provides dedicated network links from on-premises to AWS for private or public virtual interfaces and predictable capacity. Use when you need stable throughput or private VPC access; plan for encryption, routing (BGP), ordering lead time, and redundant circuits.

🏷 Keywords

Direct Connect location • virtual interface • private virtual interface • public virtual interface • hosted connection • Direct Connect Gateway • Link Aggregation Group • LAG • BGP • VLAN • dedicated connection • redundant circuits