AWS Site-to-Site VPN

A managed AWS service that provides IPsec VPN tunnel termination to connect on-premises or edge networks to Amazon VPCs or Transit Gateway attachments. It operates by establishing encrypted IPsec tunnels between a customer gateway device and an AWS virtual network endpoint, optionally using BGP for dynamic routing. It typically sits at the network perimeter to extend or interconnect networks across the public internet as part of a hybrid or multi-site architecture.

🗂 Resource Category

Networking and Content Delivery • Security, Identity, and Compliance

🧠 Exam Memory Hook

Think: "Encrypted site-to-site IPsec + BGP routing to VPC = AWS Site-to-Site VPN"

📖 Ownership

Classification: Shared Responsibility Service

AWS responsibilities: AWS operates and manages the VPN termination endpoints, the control plane APIs, the underlying AWS network fabric, and the service platform that terminates IPsec tunnels; AWS monitors and patches the physical infrastructure and managed service platform components. AWS provides CloudWatch metrics and status for tunnel health but does not operate customer gateway devices or on-premises network equipment. AWS is responsible for the availability of the managed VPN service platform according to its service model.

Customer responsibilities: The customer configures and manages the customer gateway device(s), authentication keys, tunnel parameters, routing configuration (static routes or BGP), network ACLs and security groups for VPC resources, and any on-premises firewall or NAT required. The customer is responsible for monitoring tunnel health, configuring redundancy and failover, validating routing and MTU settings, and ensuring secure key management and access control for VPN-related IAM permissions.

Patching responsibilities: AWS patches and maintains AWS-owned physical infrastructure and the managed VPN service platform components that terminate tunnels. The customer patches and maintains on-premises customer gateway hardware or virtual appliances, guest operating systems on customer-managed endpoints, installed runtimes, libraries, and applications. The hypervisor patching responsibility is AWS for AWS-managed compute, and the customer for any customer-managed compute used as a gateway.

🏗 Typical Architecture

💡 Top 5 Features

Managed IPsec VPN tunnel termination between customer gateway devices and AWS virtual network endpoints.
Support for dynamic routing using BGP and static route configurations.
Capability to provision multiple tunnels per connection for redundancy and failover.
Integration with AWS Transit Gateway and Virtual Private Gateway for scalable VPC connectivity.
CloudWatch metrics and tunnel status reporting for monitoring and alerting.

✅ Top 5 Use Cases

Extend an on-premises data centre network into one or more Amazon VPCs for hybrid applications and lift-and-shift workloads.
Provide encrypted backup or replication connectivity from on-premises storage systems to AWS over the public internet.
Use as a secure backup/failover path for AWS Direct Connect when dedicated connectivity is disrupted.
Connect multiple branch or remote sites to VPCs using VPN CloudHub or Transit Gateway attachments for inter-site communication.
Attach Transit Gateway to on-premises networks to centralise routing and simplify multi-VPC connectivity across regions and accounts.

🏗 Architecture Placement

AWS Site-to-Site VPN sits at the network edge connecting customer-managed networks to AWS virtual networking constructs (Virtual Private Gateway or Transit Gateway). Traffic is typically initiated from on-premises or branch devices and terminates on the AWS-managed VPN endpoint, which then forwards to VPCs, Transit Gateway, or other AWS networking resources. Deployment is regional in the sense that VPN endpoints attach to regional networking constructs, and routing is determined by the chosen AWS attachment (VGW or TGW).

🎯 Commonly Used With

- Amazon VPC
- AWS Transit Gateway
- AWS Direct Connect
- Amazon CloudWatch
- AWS Identity and Access Management

🌍 5 Real-World Examples

A bank extends its core data centre network to VPC-hosted core banking systems using encrypted IPsec tunnels for regulatory-required encryption in transit.
A healthcare provider replicates archival datasets to S3 from an on-premises backup appliance over an IPsec VPN to meet offsite retention requirements.
A retail chain connects regional branch office networks to central VPC services for POS aggregation and inventory synchronization using Transit Gateway with site-to-site VPN attachments.
A media company uploads large media assets from an on-premises editing facility to AWS storage services using a VPN as a secure transfer path when Direct Connect is not available.
A government agency connects isolated on-premises networks to a dedicated VPC for secure application hosting while maintaining control of on-premises security appliances.

🎓 AWS Exam Clues

Choose when you need encrypted IPsec tunnels between on-premises and VPC/Transit Gateway endpoints.
Consider BGP-based routing for dynamic route exchange and automatic route failover versus static routing.
When low-latency, predictable bandwidth is required, evaluate AWS Direct Connect and use VPN as a backup rather than as the primary connection.
Use multiple tunnels and route priority for redundancy; CloudWatch tunnel metrics are commonly used to detect failures.
Integration with Transit Gateway is preferred for centralised multi-VPC and multi-site topologies.

📝 Quick Revision

AWS Site-to-Site VPN provides managed IPsec tunnels to connect on-premises or branch networks to VPCs or Transit Gateway; use it for encrypted hybrid connectivity. Consider routing mode (BGP vs static), redundancy (multiple tunnels), monitoring (CloudWatch), and whether Direct Connect is required for consistent bandwidth.

🏷 Keywords

IPsec • BGP • Customer Gateway • Virtual Private Gateway • Transit Gateway • VPN tunnel • Redundancy • Static routing • Dynamic routing • CloudWatch metrics • VPN CloudHub • Direct Connect backup