Direct Connect Gateway

What is a Direct Connect Gateway?

A Direct Connect Gateway is an AWS networking component that lets a single AWS Direct Connect connection reach VPCs across multiple AWS regions and accounts, rather than being tied to one region. Direct Connect itself is AWS’s service for a dedicated, private physical network connection between your on-premises data center and AWS — a private circuit that bypasses the public internet entirely, giving consistent bandwidth, lower and more predictable latency, and enhanced security compared to an internet-based VPN. The Direct Connect Gateway is the piece that makes one such connection flexible: it acts as a hub so your single private link can privately reach resources spread across regions and accounts, without provisioning a separate physical connection for each.

Why it exists — private connectivity beyond the internet

To understand the gateway you need the problem Direct Connect solves and its original limitation. Organizations connecting on-premises infrastructure to AWS have two main options: an IPsec VPN over the public internet (cheap, quick to set up, but rides the unpredictable public internet with no bandwidth or latency guarantees), or Direct Connect — a dedicated private circuit (via an AWS Direct Connect location/partner) that delivers consistent high bandwidth, predictable low latency, and traffic that never touches the public internet — the choice for large, steady data transfer, latency-sensitive workloads, and strict security/compliance requirements. The catch historically was that a Direct Connect connection (via a private virtual interface) attached to a single VPC in a single region. As organizations grew to many VPCs across many regions and accounts, that meant either many expensive physical connections or complex workarounds. The Direct Connect Gateway removes this limit: it’s a globally-available hub that a single Direct Connect connection associates with, and through it that one connection can reach VPCs in any AWS region (except China) and across accounts — so you buy and maintain the physical connectivity once and use it broadly.

Where it fits, and the realities

In practice, the Direct Connect Gateway is often paired with a Transit Gateway for scalable multi-VPC connectivity: the Direct Connect Gateway brings the on-prem private link in, and the Transit Gateway fans it out to many VPCs cleanly (a common modern reference architecture). This whole area — Direct Connect, its gateway, Transit Gateway — is the toolkit for hybrid cloud networking at scale, and it parallels the equivalents on other clouds (Azure ExpressRoute, Google Cloud Interconnect). The realities to weigh: Direct Connect is more expensive and slower to provision than a VPN — you’re arranging a physical cross-connect (port fees, data-transfer charges, and often weeks of lead time via a Direct Connect partner) — so it’s justified by genuine needs for consistent bandwidth, low latency, or private-path compliance, not for small or bursty connectivity where a VPN is cheaper and faster to stand up. Redundancy matters: a single Direct Connect connection is a single point of failure, so best practice is redundant connections (ideally at different locations) and often a VPN as backup — relying on one un-redundant private circuit for critical connectivity is a real risk. And the gateway itself has scope/routing considerations (route limits, no transitive routing between VPCs through the gateway by itself — which is part of why Transit Gateway is used alongside it). The recurring mistakes: choosing Direct Connect (and its cost/lead-time) where a VPN would suffice, deploying a single connection without redundancy or VPN failover (so a circuit failure cuts hybrid connectivity), and misunderstanding the gateway’s routing scope (expecting it to transitively route between VPCs on its own).

What people get wrong

• Using Direct Connect where a VPN fits — the dedicated circuit’s cost and weeks-long provisioning are justified only by real needs for consistent bandwidth/latency or a private path; a VPN is cheaper and faster for modest needs.
• No redundancy: a single Direct Connect connection is a single point of failure — critical hybrid connectivity needs redundant circuits and/or a VPN backup, or an outage cuts you off.
• Misjudging routing scope — the Direct Connect Gateway extends one connection to many regions/accounts but doesn’t by itself transitively route between VPCs; a Transit Gateway is typically paired with it for that.

Primary source: AWS Direct Connect gateways