SAA-C03
Deep Dive
SAA-C03 tests your ability to design connectivity between on-premises and AWS. Direct Connect offers dedicated bandwidth and consistent latency. VPN is quick to set up and encrypted. Transit Gateway scales connectivity across hundreds of VPCs. You need to know when to use each one and how to combine them.
Contents
Direct Connect (DX) is a private, dedicated network connection between your on-premises data center and AWS. It doesn't go over the public internet — it goes through a Direct Connect partner or directly to an AWS location.
The key point: consistent, predictable latency, guaranteed bandwidth (1 Gbps or 10 Gbps). Traffic doesn't cross the internet — better security and performance.
Dedicated connection
1 Gbps or 10 Gbps directly from AWS to the partner location. Provisioning time: weeks or months.
When to use
Large data volumes, latency-sensitive workloads, mass migration.
Hosted connection
Through a Direct Connect partner. More flexible speeds (50 Mbps – 10 Gbps). Provisioning time: days.
When to use
Lower bandwidth requirement, more flexibility, faster provisioning.
Virtual Interfaces (VIFs) — types
Connects to resources inside a VPC via a Virtual Private Gateway. For accessing EC2, RDS, etc.
Accesses public AWS services (S3, DynamoDB, SQS) without going over the internet. Uses public AWS IPs but over the private DX connection.
Connects to Transit Gateway. Needed when you have multiple VPCs. Requires a Direct Connect Gateway.
Exam trap
Direct Connect is NOT encrypted by default. If you need encryption, add a VPN connection on top of DX (DX + VPN = IPSec over dedicated fiber). Combining DX + VPN gives you the best of both worlds: performance + encryption.
VPN establishes an encrypted IPSec tunnel over the public internet between on-premises and a VPC. It's provisioned in minutes. Ideal as a Direct Connect backup or for quick initial connectivity.
Virtual Private Gateway (VGW)
The AWS component that terminates the VPN connection on the VPC side. Attached to the VPC.
Customer Gateway (CGW)
An AWS resource representing the physical device (firewall/router) on the on-premises side.
VPN Connection
The IPSec tunnel between CGW and VGW. Always has 2 tunnels for high availability (2 AZs on the AWS side).
Accelerated Site-to-Site VPN
Uses AWS Global Accelerator to optimize VPN traffic routing. Traffic enters the AWS backbone at the nearest edge location and travels over AWS's private network to the VGW. Reduces latency and jitter compared to standard VPN over the public internet.
| Feature | Direct Connect | Site-to-Site VPN |
|---|---|---|
| Setup time | Weeks / months | Minutes |
| Bandwidth | 1–10 Gbps guaranteed | Up to ~1.25 Gbps (variable) |
| Latency | Consistent and low | Variable (public internet) |
| Encryption | Not by default (add VPN) | Yes — native IPSec |
| Cost | High (port + data) | Low ($0.05/hr + data) |
| Availability | Requires DX redundancy | Automatic dual tunnel |
| Main use case | Mass migration, critical workloads | Backup, fast connectivity, DR |
Common exam pattern: DX + VPN as a backup
Direct Connect as the primary connection (high performance). VPN as an automatic fallback if DX fails. Route propagation ensures traffic uses DX while it's available and VPN when it isn't.
AWS Transit Gateway (TGW) acts as a central hub for connecting multiple VPCs, VPN connections and Direct Connect connections. It eliminates the need for a mesh of VPC Peering connections (N*(N-1)/2 connections) and centralizes routing.
Without Transit Gateway — VPC Peering
10 VPCs = 45 peering connections
Not transitive: A↔B and B↔C does not mean A↔C
Route table management gets exponentially complex
Does not scale to dozens of VPCs
With Transit Gateway — Hub & Spoke
10 VPCs = 10 attachments to the TGW (linear)
Transitive: A → TGW → B → TGW → C
Routing centralized in the TGW Route Tables
Scales to 5,000 VPCs per TGW
Attachments supported by TGW
Exam trap
VPC Peering is fine for a handful of VPCs — not transitive, no hourly cost. Transit Gateway has a cost per attachment ($0.05/hr) + data. If the question says "10+ VPCs" or "on-premises + multiple VPCs" → TGW. If it says "2-3 VPCs talking to each other" → VPC Peering.
Direct Connect Gateway (DXGW) lets a Direct Connect connection reach multiple VPCs across multiple AWS regions (or multiple accounts). Without DXGW, a DX connection can only reach VPCs in the same region via a Private VIF.
Connects 1 DX to VPCs across multiple regions (up to 10 VGWs)
Works with Transit Gateway (Transit VIF → DXGW → TGW)
Global — doesn't belong to any specific region
Does not allow VPC-to-VPC routing through the DXGW (only on-prem → VPC)
Does not replace Transit Gateway for routing between VPCs
High-bandwidth migration
Direct Connect 10 Gbps + S3 Transfer Acceleration or DataSync. For moving petabytes without saturating the internet.
DX + DataSync (Snowball Edge no longer accepts new customers)Multi-VPC + on-premises connectivity
Transit Gateway as the hub. On-premises connects to the TGW via DX (Transit VIF) or VPN. All VPCs reachable from on-premises with centralized routing.
TGW + DX Gateway + Transit VIFDX high availability
Two DX connections in different physical locations (redundancy). Site-to-Site VPN as an additional backup. If both DX connections fail, VPN kicks in automatically.
Redundant DX + VPN fallbackPrivate access to AWS services
DX Public VIF to access S3, DynamoDB from on-premises over the private connection (no internet). Combinable with an S3 Gateway Endpoint.
DX Public VIF + VPC EndpointsDX = performance, VPN = setup speed
If the question mentions "consistent latency", "guaranteed bandwidth" or "large data volume" → Direct Connect. If it mentions "quick to set up", "immediate encryption" or "backup" → VPN.
DX is not encrypted — add VPN if required
DX's dedicated fiber has no native encryption. To encrypt traffic over DX: set up a Site-to-Site VPN over the DX connection (DX + VPN = encryption + performance).
Transit Gateway for complex networks
More than 3-4 VPCs connected to each other or to on-premises → Transit Gateway. VPC Peering is not transitive and doesn't scale. TGW centralizes routing and simplifies the topology.
Direct Connect Gateway for multi-region
A single DX reaches VPCs across multiple regions via DXGW. Without DXGW, one DX connection only reaches VPCs in the same region.
Dual-tunnel VPN = automatic high availability
Every Site-to-Site VPN has 2 IPSec tunnels across 2 different AZs on the AWS side. If one tunnel fails, the other takes over automatically. The customer doesn't need to do anything.
A visual comparison of why VPC Peering doesn't scale and how Transit Gateway simplifies the topology.
Did you get this topic?
Test what you just learned
A company has 15 VPCs in AWS and an on-premises network. They need all the VPCs to communicate with each other and with on-premises through a single Direct Connect connection. Which architecture is most appropriate?
Put what you learned to the test with original SAA-C03 exam questions.
Start SAA-C03 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.