A manufacturing company wants its on-premises ERP system to reach a private database in AWS. The architect is offered a dedicated circuit, an encrypted Site-to-Site VPN over the internet, and several ways to distribute routes between VPCs. The correct choice depends on bandwidth, latency predictability, encryption obligations, operational ownership, and what happens when a carrier or router fails. ‘Private’ and ‘reliable’ are not synonyms: a private network service can still have one physical fiber path and no tested recovery.
AWS SAA-C03 assesses secure external connections, high-performing network design, hybrid topology, VPC segmentation, and failure tolerance. The existing Transit Gateway multi-VPC architecture explains the AWS-side routing hub. This treatment begins beyond the VPC boundary, where carrier service, customer equipment, AWS connectivity, route exchange, and name resolution must align.
Capture the business path and dependency map
Document which on-premises source subnet connects to which AWS account, VPC, and application port. State whether traffic is interactive, batch-based, replication, or administrative. Record normal peak bandwidth, delay sensitivity, encryption requirements, acceptable outage duration, and potential transfer charges. A daily analytics copy may tolerate a scheduled transfer window; a synchronous database transaction may not tolerate the same variability.
Draw the return path. A Direct Connect route can make the AWS destination reachable while an on-premises firewall does not know how to return traffic through the correct interface. Overlapping private CIDRs, inconsistent route summaries, or unintended default-route propagation can break a migration before any cloud service has a chance to accept the connection.
Use Site-to-Site VPN for encrypted IP connectivity
AWS Site-to-Site VPN provides encrypted connectivity over supported public network paths. It can be appropriate for moderate bandwidth, rapid establishment, geographically distributed branches, or as a backup to a primary Direct Connect arrangement. The actual usable performance depends on customer gateway hardware, tunnel configuration, internet path characteristics, and supported AWS limits. Do not promise that encryption automatically makes the path either slower or safe from every failure.
Test both VPN tunnels where supported. A configured redundant tunnel set does not necessarily mean the customer gateway actively uses or monitors both paths correctly. Record tunnel status, IKE/IPsec negotiation, BGP sessions if used, route preference, and application success. A green IPsec association cannot prove that the correct private prefix is routed across the tunnel or that the application permits the source.
Recognize Direct Connect’s physical connectivity model
AWS Direct Connect provides dedicated connectivity through a supported AWS Direct Connect location. It can help deliver more predictable bandwidth and latency characteristics than an ordinary internet-based path, but it does not by itself provide application-layer encryption. If the business requires encrypted traffic, use an appropriate end-to-end application layer or a supported overlay or combined VPN design.
High availability needs genuinely independent connectivity. The Direct Connect Resiliency Toolkit documents models for redundant dedicated connections and placement across more than one location. Two virtual interfaces on one physical connection are not equivalent to two carriers entering different facilities. Examine the customer’s routing equipment, local power, last mile, and provider dependencies as well as the AWS endpoint.
Choose the correct AWS-side attachment and route scope
Depending on the design, private or transit virtual interfaces and gateways determine which AWS resources can be reached. A Direct Connect gateway can help associate compatible virtual private gateways or transit gateways across supported accounts and Regions under documented constraints. These components have distinct control-plane and route-propagation behavior; they are not interchangeable labels for one physical port.
Plan the path from the on-premises routing domain into the right attachment and then through the VPC route tables to the application subnet. If Transit Gateway is involved, inspect its attachment associations and propagation tables separately from VPC subnet route tables. The multi-tier VPC design is relevant because routing a packet into a private subnet still does not bypass security groups or workload authorization.
Use BGP policy rather than relying on accidental route preference
Hybrid environments often use BGP to exchange approved prefixes and provide routing alternatives. Establish which networks should be advertised in each direction, then prevent broad default routes or leaked private ranges from surprising the other side. BGP route advertisement, routing-table installation, and data-plane forwarding are different observations; test all three.
A change in local preference or advertised prefixes can shift traffic during failover. If stateful inspection or NAT occurs on only one site, asymmetric routes can cause application sessions to fail even when the new path is reachable. Do not ‘fix’ that symptom by permitting every source at the firewall. Match route policy to the intended security inspection boundary and document which sessions are expected to reset during a planned switch.
Address hybrid DNS before declaring connectivity healthy
Many applications connect using names rather than literal IP addresses. Route 53 Resolver inbound and outbound endpoints, forwarding rules, and on-premises DNS conditional forwarding can bridge selected namespaces where appropriate. A successful ping to a private IP does not establish that clients resolve the correct AWS service name or that regional failover returns an updated record.
Consider split-horizon names where an internal database endpoint should resolve privately for the factory but not expose an internal address on the public internet. Test resolution from each side of the hybrid boundary, including during path failure. DNS servers, forwarder networks, and resolver endpoint security groups become part of the application’s availability model.
Build a cost-and-resilience comparison
Include the AWS port or attachment charges, data transfer, provider circuit and cross-connect charges, VPN processing, customer equipment, and support effort. A relatively low-priced VPN is not cost-optimized if highly variable throughput prevents a required replication window. Conversely, a second dedicated circuit may be unjustified for a noncritical batch feed that can retry overnight.
Model a real failure: one Direct Connect connection fails during peak factory hours. Which BGP routes withdraw? Does traffic move to a second dedicated link or a Site-to-Site VPN? Can the backup path carry the expected traffic without saturating? Does the database’s security policy permit the new source path? The answer determines whether the resiliency budget is appropriate.
Validate an end-to-end transaction, not only a tunnel
In a controlled test, trace DNS, route advertisement, VPC route-table selection, security-group permission, application handshake, and return path. Remove one transport and measure convergence and service recovery. Use a realistic application request, not solely ICMP. Capture the change evidence and document a rollback procedure before changing a live carrier route.
A robust AWS hybrid design can say where encryption occurs, what the physical failure domains are, which route policy controls primary and backup, how private name resolution works, and who owns the circuit and endpoint. SAA-C03’s networking objective is about choosing a fit-for-purpose, testable path. The design becomes trustworthy when operators can explain why a particular packet succeeds, where it would fail, and how it will recover without opening unintended network access.