AWS Site-to-Site VPN
- What it is
- An IPsec-encrypted tunnel connecting an entire on-premises network to an AWS VPC over the public internet.
- The components
- Customer gateway (CGW) — the physical or software VPN device on your side, plus the AWS resource representing it.
- Virtual private gateway (VGW) — the AWS-side endpoint attached to one VPC. Or use a Transit Gateway to reach many VPCs through one connection.
- Each connection provides two tunnels in different Availability Zones for redundancy. Configure both — a single tunnel is a single point of failure.
- Routing
- Static routes, or dynamic with BGP (preferred — automatic failover and route propagation).
- Trade-offs
- Set up in minutes, low cost (hourly per connection plus data transfer out).
- Throughput is capped (~1.25 Gbps per tunnel) and latency varies with the public internet.
- Not to be confused with
- AWS Client VPN — individual users and laptops, not whole networks.
- AWS Direct Connect — dedicated private circuit with consistent bandwidth. Common pattern: Direct Connect primary, Site-to-Site VPN encrypted backup.
- See also
- AWS VPN for the family overview.