View a markdown version of this page

AWS Site-to-Site VPN to an Amazon VPC - Traffic Encryption Options in AWS Direct Connect
Site-to-Site VPN over Direct Connect public VIF to a VPC architectureFurther readingDiagram history

AWS Site-to-Site VPN to an Amazon VPC

Publication date: March 5, 2025 (Diagram history)

This method achieves traffic encryption by combining the benefits of the end-to-end secure IPSec connection with the low latency and consistent network experience of AWS Direct Connect when reaching resources in your Amazon VPC.

Site-to-Site VPN over Direct Connect public VIF to a VPC architecture

Architecture diagram showing traffic encryption using AWS Site-to-Site VPN over an AWS Direct Connect public VIF to reach resources in an Amazon VPC.

Configuration steps:

  1. Create an AWS Direct Connect connection. For dedicated connections, set up a cross-connect between the AWS device and your device (or partner device) at the location. For hosted connections, you must accept the hosted connection before you can use it.

  2. Once the connection is established, create an AWS Direct Connect public virtual interface (VIF) over the existing connection. Configure your customer gateway to bring up the VIF.

  3. Once the border gateway protocol (BGP) peer on the VIF is established, AWS advertises its public IP range to the customer gateway device over the public VIF.

  4. Create an AWS Site-to-Site VPN to the virtual private gateway associated to the Amazon VPC. AWS provides two VPN endpoints attached to the virtual private gateway, which have public IP addresses that are reachable over the public VIF.

  5. Configure your customer gateway with the VPN parameters to bring up the AWS Site-to-Site VPN connection.

Sample traffic flow:

  1. A client located in the corporate network needs to reach the IP address of an Amazon Elastic Compute Cloud (Amazon EC2) instance in the VPC, so the traffic is routed through the customer gateway.

  2. The customer gateway determines that the best route to the VPC is through the AWS Site-to-Site VPN tunnel. The traffic is encrypted based on cryptographic parameters for the IPSec tunnel, with the destination of the encrypted packet being the VPN endpoint public IP address.

  3. The customer gateway determines that the best route to the AWS VPN endpoint public IP address is through the Direct Connect public VIF.

  4. The AWS VPN endpoint receives the encrypted IPSec traffic and decrypts it. Because the original IP destination address is the Amazon EC2 instance in the VPC, the traffic is routed through the VPC fabric to the Amazon EC2 instance.

  5. Return traffic from the Amazon EC2 instance to the client located in the corporate network follows a reverse but identical path.

Further reading

For additional information, see the following resources:

Diagram history

To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.

ChangeDescriptionDate

Initial publication

Reference architecture diagram first published.

March 5, 2025

Initial publication

Reference architecture diagram first published.

March 5, 2025

Initial publication

Reference architecture diagram first published.

March 5, 2025

Initial publication

Reference architecture diagram first published.

March 5, 2025

Note

To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.