AWS Direct Connect vs. VPN: The Hybrid Connectivity Decision the SAA-C03 Tests Every Time
Direct Connect and Site-to-Site VPN both connect your on-premises data center to AWS — but they solve different problems under different constraints, and the SAA-C03 exploits every difference. Here's the complete guide to getting every hybrid connectivity question right on exam day.
Here is the scenario you will see on the SAA-C03:
A financial services company has a large on-premises data center that runs batch analytics jobs reading from and writing to an Amazon S3 bucket. The team reports inconsistent throughput and high latency during peak hours. The CTO requires a solution that provides a dedicated private connection with predictable performance between on-premises and AWS. What should a solutions architect recommend?
Four answer choices: AWS Site-to-Site VPN. AWS Direct Connect. AWS Client VPN. Amazon CloudFront with origin shield.
The correct answer is Direct Connect — but every option sounds plausible if you haven't internalized the one distinction that resolves hybrid connectivity questions: VPN runs over the internet; Direct Connect bypasses it entirely.
That distinction alone handles roughly 70% of SAA-C03 hybrid networking questions. The remaining 30% come from knowing the encryption trap, the failover pattern, and the virtual interface types. This post covers all of it.
The One-Sentence Mental Model
Write this down:
Site-to-Site VPN: fast to set up, encrypted by default, bounded by internet throughput. Direct Connect: slow to provision, NOT encrypted by default, dedicated private link with guaranteed bandwidth.
The two services exist on opposite ends of the same tradeoff: speed of deployment vs. consistency of performance. VPN wins on time-to-live; Direct Connect wins on throughput predictability.
On the SAA-C03, the trigger words are your fast path to the right answer:
| If the scenario says… | Answer |
|---|---|
| "quickly", "within hours", "immediately available" | Site-to-Site VPN |
| "consistent", "guaranteed bandwidth", "predictable latency" | Direct Connect |
| "not over the public internet" | Direct Connect |
| "encrypted connection to AWS" | Site-to-Site VPN (or VPN overlay on DX) |
| "failover / backup for Direct Connect" | Site-to-Site VPN |
| "1 Gbps or more, dedicated" | Direct Connect |
AWS Site-to-Site VPN: What It Is and When to Use It
AWS Site-to-Site VPN creates an IPsec-encrypted tunnel between your on-premises network and your AWS VPC. Each VPN connection consists of two tunnels — both active simultaneously — for redundancy if one tunnel endpoint becomes unavailable.
How VPN traffic flows
Your on-premises router (the Customer Gateway) establishes IPsec sessions with the Virtual Private Gateway (VGW) attached to your VPC, or with a Transit Gateway if you need to reach multiple VPCs. Traffic is encrypted end-to-end with AES-128 or AES-256 before it leaves your network, traverses the public internet, and arrives at the VGW, where it is decrypted and forwarded to the VPC.
Key VPN characteristics
- Encrypted by default: IPsec is baked in. You get authentication + encryption without additional configuration.
- Throughput: VPN throughput is bounded by internet quality. AWS supports up to 5 Gbps per tunnel on current-generation connections (older study guides still cite the earlier 1.25 Gbps limit — the SAA-C03 tests the concept, not the exact number). The actual throughput you experience depends on your internet circuit and path quality.
- Setup time: Minutes to a few hours — create a Customer Gateway, a Virtual Private Gateway, and a VPN connection in the console, download the device config, and apply it.
- Cost: Charged per VPN connection-hour ($0.05/hr in us-east-1) plus standard data transfer out charges.
- Routing: Supports both static routes and dynamic routing with BGP. BGP is required for the DX + VPN failover pattern.
When VPN is the SAA-C03 answer
Use VPN when the scenario describes quick connectivity, moderate bandwidth, an encrypted link, or a failover backup for Direct Connect. If a scenario says a team needs to connect an on-premises development environment to a VPC "this afternoon," VPN is the answer — Direct Connect cannot be provisioned that fast.
AWS Direct Connect: What It Is and When to Use It
AWS Direct Connect (DX) is a dedicated network connection between your on-premises data center and an AWS Direct Connect location — a colocation facility where your infrastructure (or your provider's) connects physically to the AWS backbone.
From the DX location, AWS extends a private virtual circuit across the AWS network to your VPC or to AWS public services. Your traffic never touches the public internet.
How Direct Connect traffic flows
Your router at the on-premises data center connects to the DX location via a cross-connect (for dedicated connections) or through an APN partner's circuit (for hosted connections). Inside AWS, the connection is configured with a Virtual Interface (VIF) that determines what you can reach:
- Private VIF → connects to a single VPC via a Virtual Private Gateway. Use this to reach EC2 instances, RDS databases, and other VPC resources by private IP.
- Public VIF → connects to AWS public endpoints (S3, DynamoDB, SQS, Kinesis) using their public IPs, but traffic travels over the AWS backbone — not the internet.
- Transit VIF → connects to a Transit Gateway, enabling one Direct Connect circuit to reach multiple VPCs and even multiple AWS accounts.
Key Direct Connect characteristics
- NOT encrypted by default. The link is dedicated and private, but there is no IPsec or TLS applied automatically. This is the #1 exam trap on Direct Connect.
- Bandwidth options: Dedicated connections come in 1 Gbps, 10 Gbps, 100 Gbps, and 400 Gbps (400 Gbps at select locations). Hosted connections via APN partners start at 50 Mbps and go up to 25 Gbps.
- Consistent, low latency: Because you bypass the internet, throughput and latency are predictable — governed by your circuit, not by internet congestion.
- Setup time: Weeks to months. Dedicated connections require ordering a physical cross-connect at a DX location and provisioning at the AWS side. Hosted connections through partners can be faster but still take days to weeks.
- Cost: Charged per port-hour plus outbound data transfer out. At high volumes, DX data transfer rates are lower than internet-based transfer costs.
When Direct Connect is the SAA-C03 answer
Use Direct Connect when the scenario mentions consistent/guaranteed performance, high throughput, large data volumes, private connectivity, or compliance requirements against internet transit. If the exam says "a media company needs to transfer 10 TB/day from on-premises to S3 with consistent throughput," Direct Connect is correct.
The Encryption Trap: Direct Connect Is NOT Encrypted
This is the most common exam trap on this topic. Candidates see "Direct Connect" and assume the dedicated private link means encrypted. It does not.
Direct Connect provides privacy through isolation — not cryptographic protection. Your traffic takes a dedicated path through AWS infrastructure, but it is not encrypted in transit unless you add encryption explicitly.
Two ways to encrypt Direct Connect traffic:
-
MACsec (IEEE 802.1AE): Layer 2 encryption between your data center and the Direct Connect location. Available on 10 Gbps and 100 Gbps dedicated connections at supported locations. MACsec is hardware-accelerated and runs at near line rate. It encrypts traffic on the segment from your router to the DX location only — not end-to-end to the VPC.
-
IPsec VPN overlay: Run a Site-to-Site VPN tunnel over a Direct Connect Public VIF. This adds IPsec encryption (Layer 3) to the entire path and provides end-to-end encryption with the consistent bandwidth of Direct Connect. This is the pattern the exam tests most: "a company uses Direct Connect but also requires encryption in transit — what should they add?"
The SAA-C03 answer: an IPsec VPN over a Direct Connect Public Virtual Interface.
The High-Availability Failover Pattern (Most Tested Architecture)
The single most-tested Direct Connect architecture on the SAA-C03 is the DX primary + VPN backup pattern. You will see some variation of this in almost every SAA-C03 hybrid connectivity question that involves high availability.
How it works:
- Both the Direct Connect Private VIF and the Site-to-Site VPN terminate at the same Virtual Private Gateway (VGW) attached to the VPC.
- BGP routing is configured on both connections. The DX connection is given a more-preferred BGP path (lower AS path length or BGP local preference). All normal traffic flows over Direct Connect.
- When the Direct Connect circuit fails, the VGW detects the BGP session drop and automatically routes traffic to the VPN tunnel within seconds — no manual intervention.
- When Direct Connect recovers, BGP reconverges and traffic shifts back.
What the exam asks: "A company has AWS Direct Connect for its primary connectivity to AWS. The company needs a highly available solution that automatically fails over to a backup connection if Direct Connect becomes unavailable. What should the solutions architect recommend?"
Answer: AWS Site-to-Site VPN as a backup connection, with BGP routing configured on both connections.
This pattern ensures that the company gets the performance of Direct Connect under normal operations and the resilience of an always-available encrypted backup. The VPN tunnels are always up (pre-established), so failover is immediate rather than requiring a VPN connection to be initiated after the failure.
For multi-region or multi-VPC architectures, Transit Gateway replaces the Virtual Private Gateway. A single Direct Connect connection with a Transit VIF can reach multiple VPCs across multiple regions, and a Transit Gateway VPN attachment provides the backup path.
Decision Tree: Direct Connect vs. Site-to-Site VPN
The flowchart below walks through the three questions that resolve any hybrid connectivity scenario on the SAA-C03:
Start here: Does the scenario require dedicated bandwidth with no internet variability?
- Yes → Direct Connect. The scenario keywords: "predictable", "guaranteed", "consistent throughput", "dedicated connection", "not over internet".
- No → Continue.
Second question: Does the scenario need the connection live within hours?
- Yes → Site-to-Site VPN. The keywords: "quickly", "immediately", "within hours", "rapid deployment".
- No → Continue.
Third question: Is the connection a failover backup for an existing Direct Connect?
- Yes → Site-to-Site VPN (the HA failover pattern above).
- No → Direct Connect, planned for when the physical provisioning timeline is acceptable.
Scenario Drills
Work through these with the decision tree before you look at the answers.
Scenario 1: A retail company has an AWS Direct Connect connection used by hundreds of on-premises applications. Leadership wants to ensure that if the connection fails, workloads can continue with minimal disruption. What should the solutions architect recommend?
<details> <summary>Answer</summary>AWS Site-to-Site VPN as a standby connection terminating at the same Virtual Private Gateway, with BGP configured to prefer the Direct Connect path. This is the standard DX + VPN HA pattern. The VPN tunnels run in the background, and BGP automatically redirects traffic within seconds of a Direct Connect failure.
</details>Scenario 2: A financial services company must transfer large volumes of sensitive data from its on-premises data center to Amazon S3 every night. The company requires a consistent 5 Gbps throughput with low latency and a dedicated connection that does not traverse the public internet. Which solution should the solutions architect recommend?
<details> <summary>Answer</summary>AWS Direct Connect with a 10 Gbps dedicated port and a Public Virtual Interface. The Public VIF gives on-premises access to S3's public endpoints over the AWS backbone. The scenario explicitly requires consistent throughput, a dedicated connection, and no public internet — all Direct Connect signals.
</details>Scenario 3: A startup needs to connect its on-premises data center to a new AWS VPC this week to begin testing. The team expects traffic of less than 500 Mbps. What should the solutions architect recommend?
<details> <summary>Answer</summary>AWS Site-to-Site VPN. The timeline ("this week") rules out Direct Connect, which takes weeks to months to provision. At 500 Mbps, VPN throughput is more than sufficient for the workload.
</details>Scenario 4: A company uses AWS Direct Connect for its hybrid connectivity. The security team now requires that all data transferred over the Direct Connect link be encrypted in transit. What is the most straightforward way to meet this requirement?
<details> <summary>Answer</summary>Configure a Site-to-Site VPN tunnel over a Direct Connect Public Virtual Interface. The IPsec tunnel provides encryption end-to-end while traffic continues to flow over the dedicated Direct Connect path. Alternatively, if the DX location and port size support it, MACsec provides Layer 2 encryption on the physical segment — but IPsec over a Public VIF is the exam-standard answer for "DX + encryption."
</details>Comparing the Two: Quick Reference
| Site-to-Site VPN | Direct Connect | |
|---|---|---|
| Path | Public internet | Dedicated private link |
| Encrypted by default | Yes (IPsec) | No |
| Max throughput | Up to 5 Gbps per tunnel | 1 Gbps to 100 Gbps+ dedicated |
| Setup time | Minutes to hours | Weeks to months |
| Latency | Variable (internet) | Consistent, low |
| Cost | Per connection-hour + data transfer | Port-hour + data transfer |
| BGP support | Yes | Yes (required) |
| Failover role | Backup for DX | Primary high-performance link |
| Use case on exam | Quick setup, backup, encryption | Consistent throughput, large data, compliance |
What to Practice Next
Now that you have the mental model, drill the exam scenarios. Try the free SAA-C03 diagnostic — ten questions across all domains, including networking — to find out where you stand before you start drilling. The CertCoach SAA-C03 practice exams include scenario-based questions that test this exact decision under exam pressure, with AI-explained answers that walk through which signal words make each option right or wrong.
For the related networking decision between VPC connectivity options, see the post on VPC Endpoints: Gateway vs. Interface — that covers the S3 and DynamoDB gateway endpoints that often appear alongside Direct Connect scenarios.
The hybrid connectivity domain is a reliable source of correct answers on the SAA-C03 once you have the mental model. Two services, one tradeoff, three key questions. That's the whole thing.