Connect a small on-premises site to private subnets in a VPC.
Use the existing internet circuit and establish an encrypted connection within a few hours. A dedicated circuit is not required.
Which connectivity option is most appropriate?
Use AWS Site-to-Site VPN when an existing internet circuit must provide a quickly established encrypted connection from on premises to a VPC.
Detailed explanation
An internet gateway provides internet routing for a VPC; it does not create an encrypted private connection or a VPN tunnel to an on-premises network.
An internet gateway provides internet routing for a VPC; it does not create an encrypted private connection or a VPN tunnel to an on-premises network.
Site-to-Site VPN encrypts traffic between on-premises equipment and a VPC using IPsec. It uses the internet and includes two tunnels for high availability.
Site-to-Site VPN encrypts traffic between on-premises equipment and a VPC using IPsec. It uses the internet and includes two tunnels for high availability.
VPC peering connects VPCs to each other and is not a service for connecting an on-premises device to a VPC.
VPC peering connects VPCs to each other and is not a service for connecting an on-premises device to a VPC.
Direct Connect provides a dedicated path but requires location and circuit preparation, and the dedicated path alone should not be treated as the solution to an encryption requirement.
Direct Connect provides a dedicated path but requires location and circuit preparation, and the dedicated path alone should not be treated as the solution to an encryption requirement.
Check official documentation
Compare the following points with the official documentation.
AWS Site-to-Site VPNのIPsecトンネル、Customer Gateway、ルーティングの公式説明を確認する。
Official references
What to confirm
オンプレミス側のCustomer GatewayとAWS側のゲートウェイを設定し、VPNトンネル経由でプライベートサブネットへ到達させる。
Key points
- AWS Site-to-Site VPN
- IPsec
- VPN tunnel
Notes
- Environment:
- Confirm current behavior in the official SAA-C03 Domain 1, Site-to-Site VPN, and Direct Connect documentation.
Foundation review
VPN versus dedicated connectivity
Compare Site-to-Site VPN for a quickly established encrypted path with Direct Connect for dedicated-path stability and bandwidth.
Routing after connectivity
Creating the connection is not enough. Align the on-premises device, AWS gateway, VPC routes, and non-overlapping CIDR ranges.