📖 What is AWS Site-to-Site VPN?
AWS Site-to-Site VPN creates a secure, encrypted tunnel between your on-premises network and your Amazon VPC over the public internet. It is a faster, lower-cost alternative to Direct Connect for establishing a secure connection to AWS resources.
"Remember that VPNs are quicker to set up than Direct Connect but are subject to the variability and latency of the public internet."
📚 Certification: AWS Certified Cloud Practitioner (CLF-C02)
🔑 What are the Key Concepts of AWS Site-to-Site VPN?
- ▸ Uses IPsec (Internet Protocol Security) to create an encrypted tunnel, ensuring that data transferred between on-premises and AWS remains private and secure.
- ▸ Requires a Virtual Private Gateway (VGW) or Transit Gateway on the AWS side to terminate the VPN connection and route traffic.
- ▸ Requires a Customer Gateway (CGW), which is the physical device or software application located on the user's on-premises network.
- ▸ Relies on the public internet for transport, meaning it is subject to network congestion and variable latency compared to dedicated lines.
🎯 How does AWS Site-to-Site VPN appear on the CLF-C02 Exam?
You may be asked to identify the most cost-effective and fastest way to establish a secure, encrypted connection between an office and a VPC when a dedicated physical line is not budgetarily feasible.
A scenario might describe a company needing a backup connection for their Direct Connect circuit to ensure high availability. You must identify Site-to-Site VPN as the appropriate redundant path.
❓ Frequently Asked Questions
How does a Site-to-Site VPN differ from a Client VPN?
Site-to-Site VPN connects an entire on-premises network to a VPC using a gateway, whereas Client VPN allows individual remote users to connect to a VPC from their own devices via software.
Is a Site-to-Site VPN a replacement for AWS Direct Connect?
Not necessarily. While both provide connectivity, VPNs are better for quick setup and low cost, while Direct Connect is superior for consistent performance and high-bandwidth requirements.