Site-to-Site VPN vs Direct Connect

Site-to-Site VPN creates an IPsec-encrypted connection over the public internet between your on-premises network and a VPC (via a Virtual Private Gateway or Transit Gateway). It can be set up in minutes given a compatible on-premises VPN device, costs relatively little, and AWS provisions two redundant tunnels by default for high availability. Its performance is subject to the variability of the public internet path between your location and AWS.

Direct Connect provisions a dedicated physical network connection from your premises (or via a Direct Connect Partner) directly into an AWS Direct Connect location, entirely bypassing the public internet. This gives much more consistent latency and higher available throughput (up to 100 Gbps), but takes real provisioning lead time — often several weeks to arrange the physical cross-connect — and costs meaningfully more, both in fixed port-hour charges and typically requiring a colocation or partner relationship.

Many production hybrid architectures use both together: Direct Connect as the primary path for its performance characteristics, with Site-to-Site VPN configured as an automatic backup that takes over if the Direct Connect circuit experiences an outage — combining the best performance characteristics with internet-based resilience as a fallback.