Module 3: Hybrid Connectivity

Advanced Architecting on AWS

Direct Connect • VPN • Transit Gateway • Hybrid DNS

🎯 Module Objectives

Design hybrid connectivity using AWS Direct Connect
Implement Site-to-Site VPN for encrypted connectivity
Use Transit Gateway as a centralized network hub
Configure hybrid DNS resolution with Route 53 Resolver
Design resilient connectivity patterns (redundancy)

🔌 AWS Direct Connect

Feature	Details
Connection Types	Dedicated (1/10/100 Gbps) or Hosted (50 Mbps–10 Gbps)
Virtual Interfaces	Private VIF (VPC), Public VIF (AWS public services), Transit VIF (TGW)
Encryption	NOT encrypted by default — use MACsec (Layer 2) or VPN over DX
Latency	Consistent, low-latency (vs. internet-based VPN)
Resiliency	Single DX = single point of failure. Use redundant connections.

Analogy: Direct Connect is like a private highway between your data center and AWS — dedicated lanes, predictable traffic, no internet congestion. But one highway can have accidents, so build two.

🔒 Site-to-Site VPN

IPsec tunnels: Encrypted over the public internet
Two tunnels per connection: Active/passive or ECMP (Equal-Cost Multi-Path)
Virtual Private Gateway (VGW): VPN endpoint on AWS side (single VPC)
Transit Gateway: Terminate VPN on TGW for multi-VPC routing
Accelerated VPN: Uses Global Accelerator for improved performance
Throughput: ~1.25 Gbps per tunnel (can aggregate with ECMP on TGW)

When to use VPN vs. DX: VPN = quick setup, encrypted, internet-based (variable latency). DX = consistent performance, higher bandwidth, requires physical installation (weeks).

🔀 Transit Gateway

Hub-and-Spoke

Central router connecting VPCs, VPNs, and Direct Connect. Eliminates full-mesh peering.

Route Tables

Multiple route tables for network segmentation (prod/dev isolation with shared services)

Attachments

VPC, VPN, DX Gateway, Peering, Connect (SD-WAN). Up to 5,000 attachments.

Bandwidth

50 Gbps per VPC attachment. Burst to 100 Gbps. ECMP support for VPN aggregation.

🌐 Hybrid DNS with Route 53 Resolver

Inbound Endpoints: On-premises DNS can forward queries to Route 53 Resolver (resolve AWS private zones)
Outbound Endpoints: Route 53 forwards queries to on-premises DNS (resolve on-prem domains)
Resolver Rules: Conditional forwarding rules (e.g., *.corp.internal → on-prem DNS)
RAM Sharing: Share resolver rules across accounts via Resource Access Manager

Pattern: Corporate apps in AWS need to resolve on-prem Active Directory names. On-prem apps need to resolve AWS private hosted zone records. Resolver endpoints bridge both worlds.

🛡️ Resilient Connectivity Patterns

Pattern	Resilience	Cost
Single DX + VPN backup	Medium — failover to VPN if DX fails	$$
Dual DX (same location)	High — survives single connection failure	$$$
Dual DX (different locations)	Maximum — survives entire facility failure	$$$$
DX + DX (different locations) + VPN	Maximum+ — triple redundancy	$$$$$

AWS recommendation: For production workloads, use at minimum two DX connections at different locations. For critical workloads, add a VPN backup as a third path.

💻 Demo: Transit Gateway & VPN

# Create a Transit Gateway
aws ec2 create-transit-gateway --description "Central-TGW" \
  --options "AmazonSideAsn=64512,AutoAcceptSharedAttachments=enable"

# Attach a VPC to Transit Gateway
aws ec2 create-transit-gateway-vpc-attachment \
  --transit-gateway-id tgw-xxxx --vpc-id vpc-xxxx \
  --subnet-ids subnet-xxxx subnet-yyyy

# Create VPN connection on TGW
aws ec2 create-vpn-connection --type ipsec.1 \
  --customer-gateway-id cgw-xxxx \
  --transit-gateway-id tgw-xxxx

🧪 Knowledge Check

Q1: A company requires consistent sub-10ms latency to AWS with 5 Gbps throughput. Which connectivity option is most appropriate?

A) Site-to-Site VPN B) AWS Direct Connect (Dedicated) C) Client VPN D) Internet with Global Accelerator

B) AWS Direct Connect (Dedicated) — Only DX provides consistent, low-latency connectivity at high throughput. VPN traverses the internet with variable latency. A 10 Gbps dedicated connection meets both requirements.

Q2: What is the purpose of a Transit Virtual Interface (Transit VIF)?

A) Connect to a single VPC B) Access AWS public services C) Connect DX to a Transit Gateway D) Encrypt DX traffic

C) Connect DX to a Transit Gateway — Transit VIFs connect Direct Connect to a Transit Gateway via a DX Gateway, enabling access to multiple VPCs through a single VIF (vs. one Private VIF per VPC).

📝 Module 3 Summary

Direct Connect

Dedicated/Hosted. Private/Public/Transit VIFs. Not encrypted by default. Use MACsec or VPN overlay.

Site-to-Site VPN

IPsec, 2 tunnels, ~1.25 Gbps/tunnel. Quick to set up. Variable latency. Accelerated option available.

Transit Gateway

Hub-and-spoke. Multiple route tables. 5000 attachments. Central routing for VPCs + VPN + DX.

Hybrid DNS

Route 53 Resolver: Inbound (on-prem→AWS), Outbound (AWS→on-prem). Share rules via RAM.