Dedicated Connection Design - Achieving Stable Private Network Connectivity with Direct Connect
This article explains design methods for dedicated line connections using AWS Direct Connect and introduces how to achieve stable private network connectivity through the choice between dedicated and hosted connections, redundant configurations, and integration with VPC.
Limitations of Internet Connectivity and the Value of Dedicated Line Connections
At the stage where a company makes full-scale use of the cloud, cases arise where connections over the internet alone cannot meet requirements for bandwidth stability, latency predictability, and security. In particular, for large-volume data transfers, workloads that require real-time performance, and regulated industries such as finance and healthcare, private network connectivity over dedicated lines is required. AWS Direct Connect is a service that connects on-premises environments and AWS with dedicated network circuits, and it provides a stable communication path that does not go through the internet. When you use Direct Connect, network latency becomes stable compared with connections over the internet. The unit price of data transfer out from AWS is also set lower than over the internet. However, because port charges are incurred as a fixed cost, whether the total becomes cheaper depends on the transfer volume and the connection configuration (for unit prices, see the pricing section below).
Choosing Between Dedicated and Hosted Connections
Direct Connect offers two connection types: Dedicated Connection and Hosted Connection. A dedicated connection lets you choose from bandwidths of 1 Gbps, 10 Gbps, 100 Gbps, and 400 Gbps, and is a connection that occupies a physical port exclusively (as of August 2026). It is suited to enterprise environments that need large-volume data transfers or stable bandwidth. Hosted connections are provided through AWS Direct Connect Partners, and you can flexibly choose a bandwidth from 50 Mbps up to 25 Gbps (25 Gbps is limited to locations that offer 100 Gbps ports). They are suited to cases where you want to start a dedicated line connection while keeping initial costs down, or where the bandwidth you need is less than 1 Gbps. By creating virtual interfaces (VIFs), you can configure multiple logical connections on a single physical connection. A private VIF is used to connect to a VPC, a public VIF to connect to AWS public services, and a transit VIF to connect to multiple VPCs via Transit Gateway.
Redundancy and High Availability Design
When you use Direct Connect in a production environment, designing a redundant configuration that eliminates single points of failure is essential. The most basic redundant configuration is the dual-location configuration, which establishes two connections at different Direct Connect locations. By choosing geographically separated locations such as Tokyo and Osaka, you can ensure resilience against natural disasters and data center failures. With Direct Connect Gateway, you can access VPCs in multiple Regions from a single connection and make connections to globally deployed workloads more efficient. When you enable SiteLink, you can route traffic between Direct Connect locations over the AWS backbone network and also use the AWS network for communication between on-premises sites. As a failover configuration, a design that places Direct Connect as the primary and Site-to-Site VPN as the secondary is also common.
VPC Integration and Network Design
In integrating Direct Connect with VPC, connecting through a Virtual Private Gateway or a Transit Gateway is the basic pattern. A Virtual Private Gateway is used to connect to a single VPC, and with a simple configuration you can establish the connection quickly. A Transit Gateway connects multiple VPCs and on-premises networks in a hub-and-spoke model and consolidates route management in large-scale multi-VPC environments. Dynamic routing with BGP (Border Gateway Protocol) achieves automatic learning of network routes and route switching during failures. Because traffic over Direct Connect passes through the AWS private network, you can transfer data securely without exposure to the internet. Encryption with MACsec (IEEE 802.1AE) is also supported, and you can encrypt data at the physical layer. However, it is supported only on 10 Gbps, 100 Gbps, and 400 Gbps dedicated connections, and only at locations (PoPs) that offer MACsec. Because 1 Gbps dedicated connections and all hosted connections are not eligible, if you include MACsec in your requirements, you need to settle the choice of connection type and location first. The following is an example of creating a Direct Connect virtual interface with the AWS CLI. aws directconnect create-private-virtual-interface --connection-id dxcon-abc12345 --new-private-virtual-interface virtualInterfaceName=my-vif,vlan=101,asn=65000,virtualGatewayId=vgw-abc12345
Direct Connect Pricing
Direct Connect port charges for dedicated connections in the Tokyo Region are $0.285 per hour for 1 Gbps and $2.142 for 10 Gbps (as of August 2026). Converted at 730 hours per month, these come to approximately $208 and approximately $1,564 per month, respectively. Data transfer charges apply only to the outbound direction and vary by Region (approximately $0.041 per GB in the Tokyo Region). Inbound is free. Partner connections (hosted) are available from 50 Mbps, and while their port charges are low, a monthly fee from the partner is incurred instead. When you secure two connections in a redundant configuration, the port charges double.
Summary
AWS Direct Connect connects on-premises environments and AWS with dedicated lines and provides stable latency, predictable bandwidth, and security through a private network. With two connection types, dedicated and hosted connections, it meets a wide range of needs from large enterprises to small and medium-sized environments. With a dual-location configuration and VPN failover, you can achieve a highly available network design. Direct Connect Gateway and SiteLink make global network connectivity more efficient, and integration with Transit Gateway simplifies route management in multi-VPC environments. For organizations that need stable private network connectivity, Direct Connect is a foundational service for cloud connectivity.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
If this page and the official documentation disagree, treat the official documentation as authoritative.