AWS whitepapers documentation change
Summary
Updated branding from 'AWS Direct Connect' to 'Direct Connect' throughout the document, including section titles, body text, image captions, and links. Removed redundant 'AWS' prefix from service names.
Security assessment
Changes are purely branding/nomenclature updates without technical security implications. No vulnerabilities, security weaknesses, or incident responses are addressed. The Private IP VPN security description remains unchanged.
Diff
diff --git a/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/direct-connect.md b/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/direct-connect.md index eedbb91da..cd9285b14 100644 --- a//whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/direct-connect.md +++ b//whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/direct-connect.md @@ -5 +5 @@ -MACsec security on Direct Connect connectionsAWS Direct Connect resiliency recommendationsAWS Direct Connect SiteLink +MACsec security on Direct Connect connectionsDirect Connect resiliency recommendationsDirect Connect SiteLink @@ -7 +7 @@ MACsec security on Direct Connect connectionsAWS Direct Connect resiliency recom -# AWS Direct Connect +# Direct Connect @@ -9 +9 @@ MACsec security on Direct Connect connectionsAWS Direct Connect resiliency recom -While VPN over internet is a great option to get started, internet connectivity may not be reliable for production traffic. Because of this unreliability, many customers choose [AWS Direct Connect](http://aws.amazon.com/directconnect/). AWS Direct Connect is a networking service that provides an alternative to using the internet to connect to AWS. Using AWS Direct Connect, data that would have previously been transported over the internet is delivered through a private network connection between your facilities and AWS. In many circumstances, private network connections can reduce costs, increase bandwidth, and provide a more consistent network experience than internet-based connections. There are several ways to use AWS Direct Connect to connect to VPCs: +While VPN over internet is a great option to get started, internet connectivity may not be reliable for production traffic. Because of this unreliability, many customers choose [Direct Connect](http://aws.amazon.com/directconnect/). Direct Connect is a networking service that provides an alternative to using the internet to connect to AWS. Using Direct Connect, data that would have previously been transported over the internet is delivered through a private network connection between your facilities and AWS. In many circumstances, private network connections can reduce costs, increase bandwidth, and provide a more consistent network experience than internet-based connections. There are several ways to use Direct Connect to connect to VPCs: @@ -11 +11 @@ While VPN over internet is a great option to get started, internet connectivity - + @@ -13 +13 @@ While VPN over internet is a great option to get started, internet connectivity -__Ways to connect your on-premises data centers using AWS Direct Connect__ +__Ways to connect your on-premises data centers using Direct Connect__ @@ -17 +17 @@ __Ways to connect your on-premises data centers using AWS Direct Connect__ - * **Option 2: Create a private VIF to a Direct Connect gateway associated with multiple VGWs (each VGW is attached to a VPC)** — A Direct Connect gateway is a globally available resource. You can create the Direct Connect gateway in any Region and access it from all other Regions, including GovCloud (excluding China). A Direct Connect Gateway can connect to up to 20 VPCs (via VGWs) globally in any AWS account over a single private VIF. This is a great option if a Landing Zone consists of a small number of VPCs (ten or fewer VPCs) and/or you need global access. There is one BGP peering session per Direct Connect Gateway per Direct Connect connection. Direct Connect gateway is only for north/south traffic flow and does not permit VPC-to-VPC connectivity. Refer to [Virtual private gateway associations](https://docs.aws.amazon.com/directconnect/latest/UserGuide/virtualgateways.html) in the AWS Direct Connect documentation for more details. With this option, the connectivity is not restricted to the AWS Region where the Direct Connect location is homed to. AWS Direct Connect gateway is only for north/south traffic flow and does not permit VPC-to-VPC connectivity. An exception to this rule is when a supernet is advertised across two or more VPCs that have their attached VGWs associated with the same AWS Direct Connect gateway and on the same virtual interface. In this case, VPCs can communicate with each other through the AWS Direct Connect endpoint. Refer to [AWS Direct Connect gateways documentation](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html) for more details. + * **Option 2: Create a private VIF to a Direct Connect gateway associated with multiple VGWs (each VGW is attached to a VPC)** — A Direct Connect gateway is a globally available resource. You can create the Direct Connect gateway in any Region and access it from all other Regions, including GovCloud (excluding China). A Direct Connect Gateway can connect to up to 20 VPCs (via VGWs) globally in any AWS account over a single private VIF. This is a great option if a Landing Zone consists of a small number of VPCs (ten or fewer VPCs) and/or you need global access. There is one BGP peering session per Direct Connect Gateway per Direct Connect connection. Direct Connect gateway is only for north/south traffic flow and does not permit VPC-to-VPC connectivity. Refer to [Virtual private gateway associations](https://docs.aws.amazon.com/directconnect/latest/UserGuide/virtualgateways.html) in the Direct Connect documentation for more details. With this option, the connectivity is not restricted to the AWS Region where the Direct Connect location is homed to. Direct Connect gateway is only for north/south traffic flow and does not permit VPC-to-VPC connectivity. An exception to this rule is when a supernet is advertised across two or more VPCs that have their attached VGWs associated with the same Direct Connect gateway and on the same virtual interface. In this case, VPCs can communicate with each other through the Direct Connect endpoint. Refer to [Direct Connect gateways documentation](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html) for more details. @@ -19 +19 @@ __Ways to connect your on-premises data centers using AWS Direct Connect__ - * **Option 3: Create a transit VIF to a Direct Connect gateway associated with Transit Gateway** — You can associate a Transit Gateway instance to a Direct Connect gateway by using a Transit VIF. AWS Direct Connect now supports connections to Transit Gateway for all port speeds, providing a more cost-effective choice for Transit Gateway users when high-speed connections (greater than 1Gbps) are not required. This enables you to use Direct Connect at speeds of 50, 100, 200, 300, 400, and 500 Mbps connecting to Transit Gateway. Transit VIF allows you to connect your on-premises data center to up to six Transit Gateway instances per AWS Direct Connect gateway (which can connect to thousands of VPCs) across different AWS Regions and AWS accounts over single transit VIF and BGP peering. This is the simplest setup among the options for connecting multiple VPCs at scale, but you should be mindful of the [Transit Gateway quotas](https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-limits.html). One key limit to note is that you can advertise only [200 prefixes](https://docs.aws.amazon.com/directconnect/latest/UserGuide/limits.html) from a Transit Gateway to on-premises router over the transit VIF. With the previous options, you pay for Direct Connect pricing. For this option, you also pay for the Transit Gateway attachment and data processing charges. For more information, refer to the [Transit Gateway Associations on Direct Connect documentation](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-transit-gateways.html). + * **Option 3: Create a transit VIF to a Direct Connect gateway associated with Transit Gateway** — You can associate a Transit Gateway instance to a Direct Connect gateway by using a Transit VIF. Direct Connect now supports connections to Transit Gateway for all port speeds, providing a more cost-effective choice for Transit Gateway users when high-speed connections (greater than 1Gbps) are not required. This enables you to use Direct Connect at speeds of 50, 100, 200, 300, 400, and 500 Mbps connecting to Transit Gateway. Transit VIF allows you to connect your on-premises data center to up to six Transit Gateway instances per Direct Connect gateway (which can connect to thousands of VPCs) across different AWS Regions and AWS accounts over single transit VIF and BGP peering. This is the simplest setup among the options for connecting multiple VPCs at scale, but you should be mindful of the [Transit Gateway quotas](https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-limits.html). One key limit to note is that you can advertise only [200 prefixes](https://docs.aws.amazon.com/directconnect/latest/UserGuide/limits.html) from a Transit Gateway to on-premises router over the transit VIF. With the previous options, you pay for Direct Connect pricing. For this option, you also pay for the Transit Gateway attachment and data processing charges. For more information, refer to the [Transit Gateway Associations on Direct Connect documentation](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-transit-gateways.html). @@ -23 +23 @@ __Ways to connect your on-premises data centers using AWS Direct Connect__ - * **Option 5: Create a VPN connection to Transit Gateway over AWS Direct Connect using Private IP VPN** — Private IP VPN is a feature that provides customers the ability to deploy AWS Site-to-Site VPN connections over Direct Connect using private IP addresses. With this feature, you can encrypt traffic between your on-premises networks and AWS through Direct Connect connections without the need for public IP addresses, thus enhancing security and network privacy at the same time. Private IP VPN is deployed on top of Transit VIFs, so it allows you to use Transit Gateway for centralized management of customers’ VPCs and connections to the on-premises networks in a more secured, private, and scalable manner. + * **Option 5: Create a VPN connection to Transit Gateway over Direct Connect using Private IP VPN** — Private IP VPN is a feature that provides customers the ability to deploy AWS Site-to-Site VPN connections over Direct Connect using private IP addresses. With this feature, you can encrypt traffic between your on-premises networks and AWS through Direct Connect connections without the need for public IP addresses, thus enhancing security and network privacy at the same time. Private IP VPN is deployed on top of Transit VIFs, so it allows you to use Transit Gateway for centralized management of customers’ VPCs and connections to the on-premises networks in a more secured, private, and scalable manner. @@ -32 +32 @@ The “transit VIF to Direct Connect gateway” option might seem to be the best -The following figure illustrates a sample setup where Transit VIF is used as a default method for connecting to VPCs and a private VIF is used for an edge use case where exceptionally large amounts of data must be transferred from an on-premises Data Center to the media VPC. Private VIF is used to avoid Transit Gateway data processing charges. As a best practice, you should have at least two connections at two different Direct Connect locations for [maximum redundancy](https://aws.amazon.com/directconnect/resiliency-recommendation/)—a total of four connections. You create one VIF per connection for a total of four private VIFs and four transit VIFs. You can also create a VPN as backup connectivity to AWS Direct Connect connections. +The following figure illustrates a sample setup where Transit VIF is used as a default method for connecting to VPCs and a private VIF is used for an edge use case where exceptionally large amounts of data must be transferred from an on-premises Data Center to the media VPC. Private VIF is used to avoid Transit Gateway data processing charges. As a best practice, you should have at least two connections at two different Direct Connect locations for [maximum redundancy](https://aws.amazon.com/directconnect/resiliency-recommendation/)—a total of four connections. You create one VIF per connection for a total of four private VIFs and four transit VIFs. You can also create a VPN as backup connectivity to Direct Connect connections. @@ -40 +40 @@ __Sample reference architecture for hybrid connectivity__ -Use the Network Services account for creating Direct Connect resources enabling demarcation of network administrative boundaries. The Direct Connect connections, Direct Connect gateways, and Transit Gateways can all reside in a Network Services account. To share the AWS Direct Connect connectivity with your Landing Zone, simply share the Transit Gateway through AWS RAM with other accounts. +Use the Network Services account for creating Direct Connect resources enabling demarcation of network administrative boundaries. The Direct Connect connections, Direct Connect gateways, and Transit Gateways can all reside in a Network Services account. To share the Direct Connect connectivity with your Landing Zone, simply share the Transit Gateway through AWS RAM with other accounts. @@ -46 +46 @@ Customers can use MAC Security Standard (MACsec) encryption (IEEE 802.1AE) with -## AWS Direct Connect resiliency recommendations +## Direct Connect resiliency recommendations @@ -48 +48 @@ Customers can use MAC Security Standard (MACsec) encryption (IEEE 802.1AE) with -With AWS Direct Connect, customers can achieve highly resilient connectivity into their Amazon VPCs and AWS resources from their on-premises networks. It is best practice that customers connect from multiple data centers to eliminate any single point physical location failures. It is also recommended that, depending on the type of workloads, customers utilize more than one Direct Connect connection for redundancy. +With Direct Connect, customers can achieve highly resilient connectivity into their Amazon VPCs and AWS resources from their on-premises networks. It is best practice that customers connect from multiple data centers to eliminate any single point physical location failures. It is also recommended that, depending on the type of workloads, customers utilize more than one Direct Connect connection for redundancy. @@ -50 +50 @@ With AWS Direct Connect, customers can achieve highly resilient connectivity int -AWS also offers the AWS Direct Connect Resiliency Toolkit, which provides customers with a connection wizard with multiple redundancy models; to help them determine which model works best for their service level agreement (SLA) requirements and design their hybrid connectivity using Direct Connect connections accordingly. For more information, refer to [AWS Direct Connect Resiliency Recommendations](https://aws.amazon.com/directconnect/resiliency-recommendation/). +AWS also offers the Direct Connect Resiliency Toolkit, which provides customers with a connection wizard with multiple redundancy models; to help them determine which model works best for their service level agreement (SLA) requirements and design their hybrid connectivity using Direct Connect connections accordingly. For more information, refer to [Direct Connect Resiliency Recommendations](https://aws.amazon.com/directconnect/resiliency-recommendation/). @@ -52 +52 @@ AWS also offers the AWS Direct Connect Resiliency Toolkit, which provides custom -## AWS Direct Connect SiteLink +## Direct Connect SiteLink @@ -54 +54 @@ AWS also offers the AWS Direct Connect Resiliency Toolkit, which provides custom -Previously, configuring site-to-site links for your on-premises networks was only possible by using direct circuit buildout through dark fiber or other technologies, IPSEC VPNs, or by using third-party circuit providers with technologies such as MPLS, MetroEthernet, or legacy T1 circuits. With the advent of SiteLink, customers can now enable direct site-to-site connectivity for their on-premises location that terminate at an AWS Direct Connect location. Use your Direct Connect circuit to provide site-to-site connectivity without having to route traffic through your VPCs, bypassing the AWS region completely. +Previously, configuring site-to-site links for your on-premises networks was only possible by using direct circuit buildout through dark fiber or other technologies, IPSEC VPNs, or by using third-party circuit providers with technologies such as MPLS, MetroEthernet, or legacy T1 circuits. With the advent of SiteLink, customers can now enable direct site-to-site connectivity for their on-premises location that terminate at an Direct Connect location. Use your Direct Connect circuit to provide site-to-site connectivity without having to route traffic through your VPCs, bypassing the AWS region completely. @@ -56 +56 @@ Previously, configuring site-to-site links for your on-premises networks was onl -Now, you can create global, reliable, and pay-as-you-go connections between the offices and data centers in your global network by sending data over the fastest path between AWS Direct Connect locations. +Now, you can create global, reliable, and pay-as-you-go connections between the offices and data centers in your global network by sending data over the fastest path between Direct Connect locations. @@ -58 +58 @@ Now, you can create global, reliable, and pay-as-you-go connections between the - + @@ -60 +60 @@ Now, you can create global, reliable, and pay-as-you-go connections between the -__Sample reference architecture for AWS Direct Connect SiteLink__ +__Sample reference architecture for Direct Connect SiteLink__ @@ -62 +62 @@ __Sample reference architecture for AWS Direct Connect SiteLink__ -When using SiteLink, you first connect your on-premises networks to AWS at any of over 100 AWS Direct Connect locations worldwide. Then, you create virtual interfaces (VIFs) on those connections and enable SiteLink. Once all VIFs are attached to the same AWS Direct Connect gateway (DXGW), you can start sending data between them. Your data follows the shortest path between AWS Direct Connect locations to its destination, using the fast, secure, and reliable AWS global network. You don’t need to have any resources in any AWS Region to use SiteLink. +When using SiteLink, you first connect your on-premises networks to AWS at any of over 100 Direct Connect locations worldwide. Then, you create virtual interfaces (VIFs) on those connections and enable SiteLink. Once all VIFs are attached to the same Direct Connect gateway (DXGW), you can start sending data between them. Your data follows the shortest path between Direct Connect locations to its destination, using the fast, secure, and reliable AWS global network. You don’t need to have any resources in any AWS Region to use SiteLink. @@ -72 +72 @@ SiteLink allows customers to use the AWS global network to function as a primary -For more information, refer to [Introducing AWS Direct Connect SiteLink](https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-direct-connect-sitelink/). +For more information, refer to [Introducing Direct Connect SiteLink](https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-direct-connect-sitelink/).