Hybrid Connectivity & Global Accelerator
Connecting your own data center to AWS, keeping traffic to AWS services off the public internet, and accelerating global traffic at the network layer.
Want a visual for this topic?
Generate a diagram tailored to Hybrid Connectivity & Global Accelerator — the AI picks whichever visual (architecture, flowchart, ER diagram, etc.) best fits this specific AWS concept.
Sign in to generate a visual →🎓 Learning objectives
- •Distinguish Site-to-Site VPN from Direct Connect and when to use each
- •Explain what a VPC Endpoint does and why it matters for security and cost
- •Explain how Global Accelerator differs from CloudFront
- •Read a VPC Flow Log to diagnose a connectivity problem
What is it?
Hybrid connectivity covers the ways an on-premises network connects to AWS (Site-to-Site VPN and Direct Connect), and the ways traffic stays private within AWS's network rather than traversing the public internet (VPC Endpoints). Global Accelerator is a related but distinct service that improves performance and availability for traffic entering AWS from anywhere in the world, using AWS's private global network backbone.
Why it exists
Most companies don't run 100% of their infrastructure in the cloud on day one — they have existing on-premises data centers, offices, or other clouds that need secure, reliable connectivity to their AWS resources. Site-to-Site VPN and Direct Connect exist to bridge that gap. Separately, calling an AWS service like S3 from within a VPC normally routes over the public internet even though both ends are technically inside AWS — VPC Endpoints exist to keep that traffic entirely on AWS's private network instead, for both security and cost reasons.
Problem it solves
It solves the hybrid infrastructure connectivity problem (securely linking on-premises networks to AWS), the private-traffic problem (keeping AWS-service-to-AWS-service traffic off the public internet even when it would otherwise route that way), and the global-performance problem (Global Accelerator routes a user's traffic onto AWS's private backbone as early as possible, rather than staying on the unpredictable public internet for the whole journey).
Intuition
Think of Direct Connect as a dedicated private road built directly between your office and an AWS data center — reliable, consistent, but takes time and money to build. Site-to-Site VPN is like an encrypted tunnel dug under the existing public highway — faster and cheaper to set up, but still subject to that highway's traffic and weather (public internet variability). A VPC Endpoint is like adding a private back door directly from your building into a partner company's warehouse next door, instead of driving all the way around through public streets to reach the same warehouse.
Analogy
Global Accelerator is like a country's national highway system that a delivery truck merges onto as close to the pickup point as possible, rather than staying on unpredictable local roads for most of the trip — CloudFront, by contrast, is more like pre-positioning the actual goods in local warehouses (caching) so a delivery barely needs to travel at all for popular items.
Technical explanation
Site-to-Site VPN establishes an IPsec-encrypted tunnel over the public internet between a Customer Gateway (your on-premises router/firewall) and a Virtual Private Gateway or Transit Gateway (the AWS side), typically set up with two tunnels for redundancy. Direct Connect instead provisions a dedicated physical network connection from your premises (or a Direct Connect Partner's facility) directly into an AWS Direct Connect location, bypassing the public internet entirely for more consistent latency and higher throughput, at higher cost and longer setup lead time (weeks, not minutes). VPC Endpoints come in two types: Interface Endpoints (an ENI with a private IP in your subnet, backed by AWS PrivateLink, used for most services) and Gateway Endpoints (a route table entry, free, but only available for S3 and DynamoDB). Global Accelerator assigns static Anycast IP addresses that route a user's traffic onto AWS's global private network backbone at the nearest AWS edge location, then carries it privately to the actual endpoint (an ALB, NLB, or EC2 instance) in whichever Region is healthiest/closest — distinct from CloudFront, which caches content rather than accelerating a network path.
Architecture
A common enterprise pattern: Direct Connect provides the primary, high-throughput link from the corporate data center to AWS, with a Site-to-Site VPN configured as an automatic backup path if the Direct Connect link fails — giving both the performance of a dedicated line and the resilience of an internet-based fallback. Separately, VPC Endpoints are added for high-traffic AWS service calls (S3, DynamoDB, and others via Interface Endpoints) from private subnets, both to avoid the data transfer cost of routing through a NAT Gateway and to eliminate that traffic's public internet exposure entirely.
Workflow
- For hybrid connectivity: start with Site-to-Site VPN for quick setup and validate connectivity requirements; if the workload later needs more consistent, higher-throughput connectivity, provision Direct Connect and optionally keep VPN as backup. 2) For private AWS service access: identify high-traffic or sensitive AWS service calls from private subnets and add Gateway Endpoints (free, for S3/DynamoDB) or Interface Endpoints (for other services) as needed. 3) For global performance: if serving latency-sensitive, non-cacheable traffic (e.g. gaming, VoIP, real-time APIs) to a global user base, evaluate Global Accelerator; if serving cacheable content, CloudFront is usually the better and cheaper fit.
Example
A bank with an on-premises core banking system uses Direct Connect as the primary link to their AWS VPC for consistent low-latency, high-throughput transaction processing, with a Site-to-Site VPN configured to automatically take over if the Direct Connect circuit has an outage. Within their VPC, application servers use a Gateway Endpoint to reach S3 for document storage entirely over AWS's private network, both avoiding NAT Gateway data processing charges and satisfying a compliance requirement that certain data never traverse the public internet.
Real-world usage
Enterprises with existing data centers migrating to AWS incrementally almost universally use Direct Connect plus VPN-as-backup as their standard hybrid connectivity pattern, documented extensively in AWS's own Well-Architected hybrid networking guidance; VPC Gateway Endpoints for S3 are a near-universal cost and security optimization recommended in AWS's cost optimization guidance for any workload with meaningful S3 traffic from private subnets.
Trade-offs
VPN is fast to provision and cheap but performance-variable; Direct Connect is consistent and high-throughput but slow to provision and costlier — most serious hybrid architectures use both, in a primary/backup arrangement, rather than choosing one exclusively. Gateway Endpoints (free, S3/DynamoDB only) versus Interface Endpoints (broader service coverage, but with real hourly and data costs) is a straightforward choice once you know which service you're connecting to — always prefer Gateway Endpoints where available. Global Accelerator versus CloudFront comes down to content type: cacheable content is almost always better and cheaper served via CloudFront; genuinely non-cacheable, latency-sensitive traffic (gaming, VoIP, real-time trading) is where Global Accelerator's network-path optimization actually earns its cost.
Visual explanation
Picture your on-premises data center on the left, connected to your VPC on the right by either a padlocked tunnel drawn over a squiggly public-internet line (Site-to-Site VPN) or a straight dedicated cable through a third-party facility (Direct Connect). Separately, inside the VPC diagram, draw a small extra door directly from a private subnet to an 'AWS S3' box, bypassing the Internet Gateway entirely — that's a VPC Endpoint.
Advantages
- —
Direct Connect provides consistent, predictable network performance, critical for latency-sensitive or high-throughput hybrid workloads
- —
Site-to-Site VPN can be set up in minutes with no special hardware beyond a compatible on-premises gateway device
- —
Gateway Endpoints for S3/DynamoDB are free and eliminate both NAT Gateway cost and public internet exposure for that traffic
- —
Global Accelerator gives static Anycast IPs that never change even as you add/remove/replace backend Regions or endpoints
Disadvantages
- —
Direct Connect has a long provisioning lead time (often weeks) and higher fixed cost, unsuitable for quick or temporary connectivity needs
- —
Site-to-Site VPN performance is subject to public internet variability — less predictable than a dedicated Direct Connect link
- —
Interface Endpoints (unlike Gateway Endpoints) have an hourly cost per endpoint per AZ plus data processing charges, which can add up across many services and AZs
- —
Global Accelerator adds cost and complexity that's wasted if your traffic is actually cacheable — CloudFront would be both cheaper and more effective in that case
Common mistakes
- —
Provisioning Direct Connect for a workload that doesn't actually need its throughput/consistency guarantees, when a much cheaper and faster-to-set-up VPN would have sufficed
- —
Not setting up a VPN backup alongside Direct Connect, leaving a single point of failure on the only hybrid connectivity path
- —
Using an Interface Endpoint for S3 or DynamoDB when the free Gateway Endpoint would have worked, paying unnecessary hourly and data processing charges
- —
Confusing Global Accelerator with CloudFront and deploying it for cacheable static content where CloudFront would be both more effective and cheaper
- —
Not checking VPC Flow Logs when diagnosing a mysterious connectivity failure — they're the definitive source of truth for whether traffic reached a network interface and whether it was accepted or rejected
In the AWS Console
- 1
AWS Console → VPC → Site-to-Site VPN Connections → Create VPN connection
Select or create a Virtual Private Gateway (or Transit Gateway) and a Customer Gateway (entering your on-premises router's public IP), then download the configuration file matching your on-premises device vendor.
AWS automatically provisions two tunnels for redundancy — configure both on your on-premises side, not just one, or you lose the automatic failover benefit.
- 2
VPC → Endpoints → Create endpoint
Search for the service (e.g. 'S3'), select the Gateway type if offered (free, S3/DynamoDB only), choose the VPC and route tables to associate it with.
For services other than S3/DynamoDB, only the Interface type will be offered — select the subnets/AZs to deploy the endpoint's network interfaces into.
- 3
VPC → Your VPCs → select VPC → Flow Logs → Create flow log
Choose the traffic type (Accept, Reject, or All), and a destination (CloudWatch Logs or S3) to send the flow log records to for later analysis.
Flow logs are essential for diagnosing 'why can't service A reach service B' — they show whether traffic actually arrived at a network interface and whether it was accepted or rejected at that layer.
- 4
AWS Console → Global Accelerator → Create accelerator
Add listeners (ports/protocols) and endpoint groups pointing at your ALBs/NLBs/EC2 instances across one or more Regions, and note the two static Anycast IP addresses assigned.
Point your DNS at these static IPs (or use them directly) — they never change even if you add, remove, or fail over between backend Regions.
🎤 Interview questions
When would you choose Direct Connect over Site-to-Site VPN? (Listen for: Direct Connect for consistent, high-throughput, latency-sensitive hybrid workloads; VPN for quick setup, lower cost, or as a backup path.)
What's the difference between a Gateway Endpoint and an Interface Endpoint? (Listen for: Gateway Endpoint is a route table entry, free, only for S3/DynamoDB; Interface Endpoint is an ENI with a private IP via PrivateLink, covers many more services, has hourly/data costs.)
Why would you use a VPC Endpoint for S3 instead of just letting traffic go through a NAT Gateway? (Listen for: avoids NAT Gateway data processing charges, keeps traffic off the public internet entirely, often a compliance requirement.)
How does Global Accelerator differ from CloudFront, and when would you choose each? (Listen for: CloudFront caches content at edge locations for cacheable traffic; Global Accelerator optimizes the network path for non-cacheable, latency-sensitive traffic by routing onto AWS's backbone earlier.)
A hybrid connection between on-premises and AWS suddenly stops working — what would you check first? (Listen for: VPN tunnel status/BGP session state or Direct Connect circuit status, route table entries on both sides, security groups/NACLs, and VPC Flow Logs to see whether traffic is arriving and being accepted or rejected.)
📂 Subtopics
Site-to-Site VPN vs Direct Connect
Two ways to connect on-premises to AWS — an encrypted tunnel over the internet versus a dedicated private circuit.
~10 min
Diagnosing Connectivity with VPC Flow Logs
The definitive source of truth for whether traffic reached a network interface and whether it was allowed or blocked.
~8 min