AWS wellarchitected documentation change
Summary
Updated terminology from 'AWS VPN' to 'Site-to-Site VPN' throughout the document, including section headers, table references, and comparisons with Direct Connect. Added explicit references to Site-to-Site VPN costs and clarified tradeoffs between VPN solutions.
Security assessment
The changes focus on terminology standardization (AWS VPN -> Site-to-Site VPN) and cost/performance comparisons. No security vulnerabilities, encryption details, or access control changes are mentioned. The discussion of VPN vs Direct Connect focuses on performance and operational considerations rather than security implications.
Diff
diff --git a/wellarchitected/latest/hybrid-networking-lens/performance-efficiency-pillar.md b/wellarchitected/latest/hybrid-networking-lens/performance-efficiency-pillar.md index d937ee343..51661f317 100644 --- a//wellarchitected/latest/hybrid-networking-lens/performance-efficiency-pillar.md +++ b//wellarchitected/latest/hybrid-networking-lens/performance-efficiency-pillar.md @@ -55 +55 @@ Based on your bandwidth requirements, a single VPN or Direct Connect connection -**HN_PERF1: How do you decide between AWS Direct Connect and AWS VPN as your connectivity option?** +**HN_PERF1: How do you decide between AWS Direct Connect and Site-to-Site VPN as your connectivity option?** @@ -63 +63 @@ Before you design the best performing architecture, define what performance mean -**Deciding between AWS Direct Connect and AWS VPN as your connectivity option** +**Deciding between AWS Direct Connect and Site-to-Site VPN as your connectivity option** @@ -65 +65 @@ Before you design the best performing architecture, define what performance mean -Based on your requirements (bandwidth, latency, jitter), you can either choose to establish VPN connectivity using AWS VPN or AWS Direct Connect (or both). The following information will help you guide the path to take. +Based on your requirements (bandwidth, latency, jitter), you can either choose to establish VPN connectivity using Site-to-Site VPN or AWS Direct Connect (or both). The following information will help you guide the path to take. @@ -67 +67 @@ Based on your requirements (bandwidth, latency, jitter), you can either choose t -_Table 1 - Guided path for deciding between AWS VPN and AWS Direct Connect_ +_Table 1 - Guided path for deciding between Site-to-Site VPN and AWS Direct Connect_ @@ -69 +69 @@ _Table 1 - Guided path for deciding between AWS VPN and AWS Direct Connect_ -**Characteristic** | **AWS VPN** | **AWS Direct Connect** +**Characteristic** | **Site-to-Site VPN** | **AWS Direct Connect** @@ -75 +75 @@ Jitter | Medium: It’s hard to predict the number of hops the traffic travers -As depicted in the previous table, the best performing and recommended option is AWS Direct Connect for production workloads. To get started quickly while getting good performance for your development/sandbox environments, choose AWS VPN. It is very important to always work backwards for your use case and requirements to make the right technology choice. You can also choose a hybrid design where they leverage both AWS VPN and AWS Direct Connect. +As depicted in the previous table, the best performing and recommended option is AWS Direct Connect for production workloads. To get started quickly while getting good performance for your development/sandbox environments, choose Site-to-Site VPN. It is very important to always work backwards for your use case and requirements to make the right technology choice. You can also choose a hybrid design where they leverage both Site-to-Site VPN and AWS Direct Connect. @@ -209 +209 @@ When deciding on which technology to choose (VPN vs dedicated circuits) or which -**Tradeoffs between AWS VPN and AWS Direct Connect on cost and time to setup:** +**Tradeoffs between Site-to-Site VPN and AWS Direct Connect on cost and time to setup:** @@ -211 +211 @@ When deciding on which technology to choose (VPN vs dedicated circuits) or which -The following tables show different factors to consider when making a choice between AWS VPN and Direct Connect. +The following tables show different factors to consider when making a choice between Site-to-Site VPN and Direct Connect. @@ -213 +213 @@ The following tables show different factors to consider when making a choice bet -_Table 2 - Tradeoffs between AWS VPN and AWS Direct Connect on cost and time to setup_ +_Table 2 - Tradeoffs between Site-to-Site VPN and AWS Direct Connect on cost and time to setup_ @@ -215 +215 @@ _Table 2 - Tradeoffs between AWS VPN and AWS Direct Connect on cost and time to -**Tradeoff** | **AWS VPN** | **AWS Direct Connect** +**Tradeoff** | **Site-to-Site VPN** | **AWS Direct Connect** @@ -217 +217 @@ _Table 2 - Tradeoffs between AWS VPN and AWS Direct Connect on cost and time to -Cost | Low: If you have an active already paid for internet connection at the customer end, you pay for [AWS VPN costs](https://aws.amazon.com/vpn/pricing/). | Low-Medium: Data transfer out cost over Direct Connect is lower than that over VPN. If you don’t have existing circuits to a Direct Connect location, you may have to pay for circuit costs to your service provider in addition to AWS [Direct connect hourly charge](https://aws.amazon.com/directconnect/pricing/). +Cost | Low: If you have an active already paid for internet connection at the customer end, you pay for [Site-to-Site VPN costs](https://aws.amazon.com/vpn/pricing/). | Low-Medium: Data transfer out cost over Direct Connect is lower than that over VPN. If you don’t have existing circuits to a Direct Connect location, you may have to pay for circuit costs to your service provider in addition to AWS [Direct connect hourly charge](https://aws.amazon.com/directconnect/pricing/). @@ -225 +225 @@ Performance | Medium: medium bandwidth (based on internet speeds), medium-high -_Table 3 - Tradeoffs between AWS VPN and VPN termination on EC2 instances_ +_Table 3 - Tradeoffs between Site-to-Site VPN and VPN termination on EC2 instances_ @@ -227 +227 @@ _Table 3 - Tradeoffs between AWS VPN and VPN termination on EC2 instances_ -**Tradeoff** | **Virtual appliance on EC2 instance** | **AWS VPN (on AWS Transit Gateway)** +**Tradeoff** | **Virtual appliance on EC2 instance** | **Site-to-Site VPN (on AWS Transit Gateway)** @@ -229,2 +229,2 @@ _Table 3 - Tradeoffs between AWS VPN and VPN termination on EC2 instances_ -Cost | Medium - High: You pay for [EC2 instance pricing](https://aws.amazon.com/ec2/pricing/) (2 or more instances for HA) in addition to any third-party licensing fees. | Low: You pay for [AWS VPN costs](https://aws.amazon.com/vpn/pricing/) (hourly charge + data transfer). -Setup complexity and management overhead | High: Management and maintenance of EC2 instances is customer responsibility. | Low: AWS VPN is a fully managed solution. +Cost | Medium - High: You pay for [EC2 instance pricing](https://aws.amazon.com/ec2/pricing/) (2 or more instances for HA) in addition to any third-party licensing fees. | Low: You pay for [Site-to-Site VPN costs](https://aws.amazon.com/vpn/pricing/) (hourly charge + data transfer). +Setup complexity and management overhead | High: Management and maintenance of EC2 instances is customer responsibility. | Low: Site-to-Site VPN is a fully managed solution. @@ -232 +232 @@ Scalability and performance | Low-medium: You can vertically scale an EC2 inst -3rd party features | High: You can choose a third-party vendor software to get additional functionality like DMVPN ([Dynamic Multipoint VPN,](https://www.cisco.com/c/en/us/products/security/dynamic-multipoint-vpn-dmvpn/index.html) a Cisco VPN protocol). | Low-medium: AWS VPN doesn’t support third-party proprietary features like DMVPN. +3rd party features | High: You can choose a third-party vendor software to get additional functionality like DMVPN ([Dynamic Multipoint VPN,](https://www.cisco.com/c/en/us/products/security/dynamic-multipoint-vpn-dmvpn/index.html) a Cisco VPN protocol). | Low-medium: Site-to-Site VPN doesn’t support third-party proprietary features like DMVPN. @@ -236 +236 @@ Scalability and performance | Low-medium: You can vertically scale an EC2 inst -**Example: Where you can tradeoff third-party features for performance** \- If you standardize on using DMVP for all your sites and but want a fully managed, scalable solution for your production workloads, the recommended approach is to take time to move to IPSEC VPN connectivity leveraging AWS VPN. +**Example: Where you can tradeoff third-party features for performance** \- If you standardize on using DMVP for all your sites and but want a fully managed, scalable solution for your production workloads, the recommended approach is to take time to move to IPSEC VPN connectivity leveraging Site-to-Site VPN.