- Now let's talk about AWS Direct Connect.
With Direct Connect, we have the ability to gain
a dedicated private fiber connection into AWS,
and these come in either one gigabit per second
or 10 gigabit per second options.
Those are the two most common.
It is possible to get a Direct Connect connection
that is lower than one gigabit per second
but those are actually the most common.
And we can use this to establish private connectivity
into one or more VPCs within that region
or to gain access to Amazon services
such as S3 or DynamoDB in that particular region.
Keep in mind that any bandwidth
that leaves an Amazon region that goes over the Internet,
we will pay bandwidth for.
And so, if you're doing a lot of transfer
between Amazon services like S3 for example,
if you're using the internet,
then you're going to pay a particular fee.
But with Direct Connect, we get lower data transfer rates
than using the internet.
So if we have very significant volumes of data,
it could be cheaper for us to leverage Direct Connect
in order to gain access to those lower bandwidth charges.
Direct Connect also gives us a significant increase
in bandwidth and throughput as opposed to
accessing in Amazon services through the internet.
It gives us more consistent network performance.
And in order to use this, in order to set up the routers,
you know, between on premises and AWS,
it does require us to leverage
External Border Gateway Protocol, or eBPG.
There are a number of AWS Direct Connect providers.
We generally work with some type of a provider
within the Amazon partner network
that can help us run that fiber line
between our location and AWS.
And some of those providers, depending on where you are,
could be Equinix, Interxion, Cologix, Digital Realty.
There is a number of different providers
that we might look to,
again, depending on the region that you're in,
or the country that you're operating in.
And so, we have our location wherever that is.
It could be on premises.
It could be a co-location somewhere, some remote facility.
And we generally work with an AWS partner,
some service provider.
They would run a line between our location
and AWS Direct Connect facility, or point of presence.
From there, AWS already has lines
going into that particular region.
Once we have our Direct Connect connection into that region,
we can then divide that Direct Connect connection
into multiple VLANs.
So let's start at the top here
and take a look at this diagram.
You'll notice here that I have
several different AWS services such as Simple Queue Service,
Simple Notification Service, S3 and DynamoDB.
AWS services exist within a public address space.
So if you were to communicate to these services directly,
apart from Direct Connect,
you would reach those services over public IP addresses.
And so, it is possible to still reach those services,
still using public IP addresses over Direct Connect,
and we can achieve that through routing.
We can route Amazon's public IP space
through our Direct Connect.
And so, in order to do that,
we would have to divide this Direct Connect connection
into multiple VLANs,
and we would assign one VLAN to that public address space.
And that would allow us to reach those Amazon services.
If we also wanted to use that same Direct Connect connection
to reach multiple VPCs,
then we would divide that connection again into VLANs.
Each VPC would get its own VLAN, right?
And so that would enable us to access services
running within these VPCs.
So if we had instances here, we could reach those instances
on private IP addresses.
It is worth noting that even though
this is a dedicated private connection using a VLAN,
it is not encrypted by default.
So a VPN and a VLAN through Direct Connect
are two different things, right?
So keep that in mind that just because you have a VLAN
over Direct Connect does not mean
that this traffic is encrypted.
So if you have regulatory need
to encrypt that traffic end-to-end,
then you would have to do something in addition to this VLAN
in order to make that happen, right?
So keep that in mind that Direct Connect
gives us a dedicated private fiber connection
generally in one or 10 gigabit per second options.