AWS Site to Site VPN
VPN to connect on-prem networks
Creates encrypted IPsec tunnels over the Internet between an on-prem router (customer gateway) and a Virtual Private Gateway or Transit Gateway; each connection has 2 tunnels for redundancy.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsCLF · SAA · SOA
Think of it asLike an armored truck carrying goods between two warehouses on public roads.
When to use it
✓ Use it when
You need to connect an office/data center to a VPC quickly and at low cost.
✗ Avoid it when
You need high bandwidth and consistent latency → Direct Connect; individual users → Client VPN.
Common uses
- Connecting an office to a VPC within a few hours
- Backup path for Direct Connect
- Encrypting traffic over Direct Connect
What does it cost?
- Pricing model: Charged hourly per VPN connection plus data transfer out fees.
When the question asks for a quick, cheap, encrypted link between on-premises and a VPC, choose Site-to-Site VPN; for high, stable bandwidth and low latency, Direct Connect; for a cheap backup for Direct Connect, add Site-to-Site VPN.
Frequently asked questions
How is Site-to-Site VPN different from Direct Connect?
VPN runs over the public Internet but is encrypted with IPsec, can be set up in minutes and is cheap; in return, bandwidth and latency depend on the Internet path. Direct Connect is a dedicated physical link with higher, more consistent bandwidth, but takes time to provision and is not encrypted by default.
Why does each VPN connection have two tunnels?
The two tunnels end on different AWS endpoints (usually in two AZs), so traffic fails over if one side is under maintenance or fails. For real resilience, configure both tunnels on your on-premises device as well and use BGP (dynamic routing) rather than static routes.
How can I increase VPN bandwidth or reliability?
Each tunnel has its own bandwidth cap. If you attach the VPN to a Transit Gateway, you can enable ECMP to spread traffic across multiple tunnels or VPN connections. For reliability, use VPN as a backup path for Direct Connect, or use Accelerated VPN, which goes through the AWS Global Accelerator network.
Related services
SAA-C03 study guide
Site-to-Site VPN is covered in these study modules: