AWS First Steps
LanguageEnglish
Networking

Building Dedicated Connections with AWS Direct Connect - Redundancy Design and Traffic Control

Design redundant dedicated connections and connect to VPCs across multiple regions with Direct Connect Gateway. This article also covers bandwidth aggregation with LAG and MACsec encryption.

About 6 min read

Overview of Direct Connect

Direct Connect is a service that connects your on-premises environment to AWS over a dedicated line. Compared to internet VPN, it provides stable bandwidth, lower latency, and reduced data transfer costs. It offers 1 Gbps and 10 Gbps dedicated connections, as well as hosted connections from 50 Mbps to 10 Gbps. With Direct Connect Gateway, you can access VPCs in multiple regions through a single connection.

Redundancy Design and Direct Connect Gateway

For production environments, a dual-location configuration with two connections placed at different locations (data centers) is recommended. If one location experiences a failure, communication continues through the other. Direct Connect Gateway enables access to VPCs in multiple regions from a single connection, eliminating the need for separate connections per region. When combined with Transit Gateway, you can connect to Transit Gateway via Direct Connect Gateway and access all VPCs under that Transit Gateway.

High Availability and Encryption with LAG and MACsec

Link Aggregation Group (LAG) bundles multiple Direct Connect connections into a single logical interface, providing bandwidth aggregation and failover when a link fails. All connections within a LAG must have the same bandwidth and be located at the same location. Enabling MACsec (IEEE 802.1AE) encrypts data on the Direct Connect connection at Layer 2, preventing eavesdropping on the physical line. MACsec is supported on 10 Gbps and 100 Gbps dedicated connections, and you configure CKN/CAK pairs for key association. Enabling SiteLink allows direct communication between different Direct Connect locations via the AWS backbone, letting you leverage the AWS network for connectivity between on-premises sites as well.

Direct Connect Cost Structure

Direct Connect costs consist of port-hour charges and data transfer charges. The port charge for a dedicated connection is a fixed monthly rate based on bandwidth; for example, 1 Gbps costs approximately USD 0.30/hour (as of August 2026). Data transfer charges apply only to outbound traffic (AWS to on-premises); inbound is free. Hosted connections are available from 50 Mbps through partners and are cost-effective for small workloads. Using Direct Connect Gateway, you can access VPCs in multiple regions with a single connection, eliminating the need for per-region connections. When monthly traffic exceeds 1 TB, there are more cases in which Direct Connect has the advantage over VPN in data transfer costs.

Types of Virtual Interfaces (VIF)

On top of a single physical connection, you create virtual interfaces (VIF) for different purposes. A private VIF is for connecting to private IP resources in a VPC and is the most common. A public VIF is used to reach public endpoints such as S3 and DynamoDB over the dedicated line without going through the internet. A transit VIF connects to Transit Gateway via Direct Connect Gateway and provides consolidated access to many VPCs. By using different VIFs according to your requirements, you can use one line for multiple purposes.

BGP and Routing Design

Route control for Direct Connect is done with BGP. BGP sessions are established between the on-premises side and the AWS side, and they exchange routes with each other. In a redundant configuration, you adjust the AS path length and BGP attributes to control the primary line used in normal times and the backup line that is switched to during a failure. By appropriately narrowing down the routes you advertise, you prevent unintended routes from coming in. If you want to speed up failover, enabling BFD (Bidirectional Forwarding Detection) means you can detect link failures sooner and switch routes, and you can shorten downtime.

Hybrid DNS and Name Resolution

After connecting on-premises and the VPC with a dedicated line, you design bidirectional name resolution. If you place a Route 53 Resolver inbound endpoint, on-premises DNS can resolve private hostnames within the VPC. With an outbound endpoint, resources in the VPC can forward queries to on-premises DNS. This means cloud and on-premises servers can refer to each other by hostname, and operations that do not rely on hard-coded IP addresses become possible. Make the name resolution path redundant as well, so that a failure on either side does not stop everything.

Adoption Process and Resilience Best Practices

Provisioning a dedicated connection takes lead time, because AWS issues a document describing the location information and the physical cross-connect with the data center operator has to be completed. It is realistic to place the order early once the requirements are settled. From a resilience perspective, a single connection and a single location each become a single point of failure, so in production the basic configuration is two lines to separate locations. In addition, if you set up a VPN alongside it as a backup path in case the dedicated line itself goes down, you can raise availability a level higher. Run switchover tests regularly to confirm that failover happens as expected.

Summary

Direct Connect is a service that connects your on-premises environment to AWS over a dedicated line, providing a stable, low-latency network. LAG aggregates bandwidth, and MACsec provides Layer 2 encryption. Direct Connect Gateway enables access to VPCs in multiple regions from a single connection, and SiteLink lets you leverage the AWS backbone for communication between on-premises sites.

References (Official AWS Resources)

The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.

If this page and the official documentation disagree, treat the official documentation as authoritative.

Share

Related Services

AWS Direct Connect PopularA service that provides a dedicated network connection between on-premises and AWS for stable, low-latency connectivityAmazon VPC EssentialBuild a logically isolated virtual network on AWSAWS Transit Gateway PopularA network hub that connects multiple VPCs and on-premises networks in a hub-and-spoke topology

Related Articles

Global Network Optimization with AWS Global Accelerator - Low-Latency Delivery and FailoverLearn how to route traffic onto the AWS global network using Anycast IPs, design endpoint groups, and achieve failover through health checks.Visualizing Your Global Network with AWS Network Manager - Centralized Management of Topology and HealthThis article introduces techniques for visualizing the topology of a global network that includes Transit Gateway and VPN, and for verifying connectivity with route analysis.Building a Hub-and-Spoke Network with AWS Transit Gateway - Designing Multi-VPC ConnectivityConsolidates multiple VPCs and on-premises networks in a hub-and-spoke topology and establishes security boundaries through route table isolation. It also introduces multi-region connectivity through peering.

More on This Topic

Building a Service Mesh with AWS App Mesh - Controlling and Observing Microservice CommunicationLearn how to declaratively configure canary deployments, retry policies, and mTLS encryption using Envoy sidecars, and visualize service dependencies with X-Ray integration (AWS discontinued support for App Mesh on September 30, 2026).Service Discovery with AWS Cloud Map - Dynamic Name Resolution for MicroservicesDynamically discover microservice endpoints using DNS-based and API-based approaches. Learn how to automate service registration and deregistration through integration with ECS and EKS.How CloudFront PoP Selection Works - DNS Routing and the Cache HierarchyThis article explains the DNS-based routing that CloudFront uses to route user requests to the nearest PoP, the multi-layer cache structure of edge locations and regional edge caches, and the design factors that determine the cache hit ratio.Dedicated Connection Design - Achieving Stable Private Network Connectivity with Direct ConnectThis article explains design methods for dedicated line connections using AWS Direct Connect and introduces how to achieve stable private network connectivity through the choice between dedicated and hosted connections, redundant configurations, and integration with VPC.Elastic IP Address Management and Design - Static IP Usage and Cost OptimizationLearn about Elastic IP allocation, EC2 association, cost implications of unused EIPs, and alternative approaches to consider.Why ELB Is Split into 4 Types - Behind the Design Decisions of ALB / NLB / GWLB / CLBThis article explains why the 4 load balancer types, ALB, NLB, GWLB, and CLB (Classic), coexist instead of being unified, from the layers of the OSI reference model, their performance characteristics, and their history.Global Network Optimization with AWS Global Accelerator - Low-Latency Delivery and FailoverLearn how to route traffic onto the AWS global network using Anycast IPs, design endpoint groups, and achieve failover through health checks.Global Network Acceleration - Low-Latency Delivery with AWS Global Accelerator and CloudFrontRoute traffic onto the AWS global network early using Anycast IPs to direct clients to the nearest edge location. This guide covers ALB/NLB integration and failover design.

Similar Articles and Services

Dedicated Connection Design - Achieving Stable Private Network Connectivity with Direct ConnectThis article explains design methods for dedicated line connections using AWS Direct Connect and introduces how to achieve stable private network connectivity through the choice between dedicated and hosted connections, redundant configurations, and integration with VPC.AWS Direct ConnectA service that provides a dedicated network connection between on-premises environments and AWS, delivering stable, low-latency connectivity that bypasses the public internetThe Depth of AWS Networking Services - Enterprise Network Design with VPC, Transit Gateway, and PrivateLinkThis article examines AWS networking services centered on VPC, Transit Gateway, PrivateLink, Direct Connect, and Network Firewall, comparing them with Azure VNet/ExpressRoute and GCP VPC/Cloud Interconnect to explain the flexibility advantages in enterprise network design.Building a Hub-and-Spoke Network with AWS Transit Gateway - Designing Multi-VPC ConnectivityConsolidates multiple VPCs and on-premises networks in a hub-and-spoke topology and establishes security boundaries through route table isolation. It also introduces multi-region connectivity through peering.