AWS Direct Connect

What is Direct Connect?

AWS Direct Connect is a private physical link — 1, 10, or 100 Gbps ports at colocation facilities — between your network and AWS, bypassing the public internet entirely. Traffic rides your circuit to a Direct Connect location, then AWS’s backbone. You get what the internet can’t promise: consistent latency (no congestion variance), predictable throughput for bulk movement, and traffic that never transits public infrastructure — the checkbox certain regulators and enterprise security teams require.

The economics: when the circuit pays for itself

Direct Connect egress runs roughly $0.02/GB versus ~$0.09/GB internet egress. Against port-hour costs (a 10 Gbps port ≈ $1.6k/month) plus cross-connect and colo fees, the arithmetic breaks even around tens of terabytes of monthly egress — below that, a VPN over the internet is the rational choice; above it, Direct Connect is often cheaper while being faster. Hybrid architectures with constant database replication or nightly bulk sync hit that threshold quickly.

What the SLA fine print teaches

One circuit is one cable — backhoes exist. Production-grade hybrid connectivity means two circuits at different Direct Connect locations (the resilience models AWS’s SLA actually rewards), typically with a VPN as warm standby, and BGP configured so failover is automatic rather than a change-ticket. Provisioning is measured in weeks (port, cross-connect, carrier last-mile), so Direct Connect belongs in migration timelines, not sprint plans.

What people get wrong

• Single-circuit production dependencies — the outage postmortem writes itself.
• Assuming encryption: Direct Connect is private, not encrypted; compliance frameworks usually still require MACsec or IPsec on top.
• Sizing for peak day-one instead of starting hosted (sub-1 Gbps via partners) and upgrading with evidence.

Primary source: AWS Direct Connect documentation

Direct Connect vs. VPN

AWS Direct Connect establishes a dedicated, physical network connection between an organization’s data center and AWS, bypassing the public internet entirely for that traffic — in contrast to a VPN, which encrypts traffic but still routes it over the shared public internet. This distinction matters for both performance and cost: Direct Connect offers more consistent, predictable latency and bandwidth (important for latency-sensitive hybrid applications or large data transfer workloads) and can be more cost-effective at high data transfer volumes, but requires physical infrastructure setup through a Direct Connect location or partner, taking weeks to provision compared to a VPN connection that can be established in minutes.