AWS Networking: Virtual Private Network (VPN)
In the AWS ecosystem, a VPN provides a way to establish a secure, encrypted tunnel between your on-premises network (or individual devices) and your AWS VPCs over the public internet. For the SAA-C03 exam, you must understand when to use VPN versus Direct Connect, how to scale with Transit Gateway, and how to optimize performance.
Core VPN Components
1. AWS Site-to-Site VPN
Connects your entire data center or office to an AWS VPC. It consists of two main parts:
- Customer Gateway (CGW): A physical device or software application on your side of the connection. You must provide its public IP address to AWS.
- Virtual Private Gateway (VGW): The VPN concentrator on the Amazon side attached to a single VPC.
- Transit Gateway (TGW): An alternative to VGW that allows a single VPN connection to talk to multiple VPCs and on-premises networks.
2. AWS Client VPN
A managed client-based VPN service that enables users to securely access AWS resources and on-premises networks from anywhere using an OpenVPN-based client.
Routing Options
- Static Routing: You manually enter the IP ranges (routes) for your network. Best for simple setups or older hardware that doesn’t support BGP.
- Dynamic Routing (BGP): Uses Border Gateway Protocol. AWS learns your routes automatically. This is highly recommended for failover and redundancy.
Comparison: VPN vs. Direct Connect (DX)
| Feature | Site-to-Site VPN | Direct Connect (DX) |
|---|---|---|
| Setup Time | Minutes | Weeks to Months |
| Cost | Low (Hourly + Data Transfer) | High (Port fees + Cross-connects) |
| Bandwidth | Up to 1.25 Gbps per tunnel | 1 Gbps, 10 Gbps, or 100 Gbps |
| Protocol | IPsec (Encrypted by default) | 802.1Q VLAN (Not encrypted by default) |
| Reliability | Uses Public Internet (Variable) | Private Fiber (Consistent) |
Accelerated Site-to-Site VPN
Normally, VPN traffic travels over the public internet, which can have high latency. Accelerated VPN uses AWS Global Accelerator to route traffic to the nearest AWS Edge Location, then carries it over the optimized AWS Global Network to your VPC. Use this when you need the fastest possible VPN performance across long geographic distances.
Exam Tips and Gotchas
- The 1.25 Gbps Limit: A single VPN tunnel is capped at 1.25 Gbps. If the exam asks for 10 Gbps, VPN is the wrong answer unless you are using ECMP (Equal-Cost Multi-Path) with Transit Gateway.
- Encryption: VPN is encrypted (IPsec). Direct Connect is NOT encrypted by default. To have an encrypted 10 Gbps line, you must run a “VPN over Direct Connect.”
- Redundancy: AWS provides two tunnels for every Site-to-Site VPN. For high availability, ensure your on-premises CGW is configured to use both.
- CloudWatch Integration: Use CloudWatch to monitor Tunnel State (Up/Down) and Data Throughput.
- IP Overlap: You cannot establish a VPN if your on-premises CIDR block overlaps with your VPC CIDR block.
Decision Matrix / If–Then Guide
| If the requirement is… | Choose… |
|---|---|
| Immediate connectivity to start a migration | Site-to-Site VPN |
| Connecting to 50+ VPCs from one office | Transit Gateway + VPN |
| Secure remote access for employees at home | AWS Client VPN |
| Predictable network performance and high bandwidth | Direct Connect |
| Encryption over a Direct Connect line | VPN over Direct Connect (Public VIF) |
Topics covered:
Summary of key subtopics covered in this guide:
- Site-to-Site VPN (CGW, VGW, TGW)
- Client VPN (Endpoint management)
- Static vs. Dynamic (BGP) Routing
- Accelerated VPN (Global Accelerator)
- VPN vs. Direct Connect trade-offs
- High Availability and Redundancy patterns
AWS VPN Architecture Infographic
IAM: Control who can manage VPN connections.
CloudWatch: Monitor tunnel status and data metrics.
KMS: Used for managing encryption keys if required.
Transit Gateway: Hub-and-spoke model for massive scaling.
Standard: 1.25 Gbps per tunnel.
Accelerated: Uses Global Accelerator to reduce jitter and latency.
ECMP: Use multiple tunnels with Transit Gateway to scale bandwidth beyond 1.25 Gbps.
Pay-as-you-go: Hourly connection fee + standard data transfer out (DTO) rates.
Tip: Delete unused VPN connections to stop the hourly “Connection Hour” charge.
Production Use Case: Hybrid Cloud Migration
A company is migrating its database to AWS. They need a secure connection immediately to start data replication. They set up a Site-to-Site VPN with BGP for automatic failover. Later, as data volume grows, they provision a Direct Connect for consistent 10 Gbps speeds, keeping the VPN as a cost-effective backup.