AWS Direct Connect vs Site-to-Site VPN: Cost, Latency and When to Use Which

Quick Answer: AWS Direct Connect vs VPN, honestly: a Site-to-Site VPN is an encrypted tunnel over the public internet — ready in minutes, roughly USD 0.05 per hour per connection plus data transfer, with variable latency. Direct Connect is a dedicated physical connection provisioned through a partner — hundreds of dollars per month for a 1 Gbps port, weeks to install, with consistent low latency and no internet path. Use VPN to start, for burst traffic and as a permanent backup; use Direct Connect once you have sustained hybrid traffic, a latency requirement, or a data-residency rule. Serious hybrid deployments almost always run both.

What Are You Actually Choosing Between?

Start with what each thing is, because the comparison is usually framed as “better versus worse” when it is really “different physics”.

A Site-to-Site VPN is IPsec encryption over the public internet. AWS terminates one end, your router or firewall terminates the other, BGP rides over the tunnel, and traffic leaves your data centre bound for AWS across the same internet path your office web browsing uses. Provisioning is a console click or an API call; you are running within minutes. The constraints are inherent to the medium: shared capacity, variable latency, jitter during peak hours, and bandwidth ceilings set by your router’s crypto throughput — which is frequently the real limit, not the link.

AWS Direct Connect is a physical connection. You order a port through an AWS partner or colocation provider, cross-connect to an AWS router in the facility, and create virtual interfaces — private VIFs for VPC access, transit VIFs for Transit Gateway, public VIFs for AWS public services. Traffic never touches the internet between you and AWS. Latency is consistent rather than merely low, throughput is the port speed you provisioned, and MTU can run at 9,000 bytes instead of 1,500. The costs are a recurring port fee, data-transfer pricing that is cheaper than internet egress, and a lead time measured in weeks — occasionally months if the cross-connect is not already in place.

Direct Connect vs VPN: Head-to-Head

The encryption row deserves emphasis because it surprises people. Direct Connect does not encrypt your traffic. It is a private circuit, which is a different guarantee than confidentiality — and plenty of compliance reviewers treat them as the same thing until you show them otherwise. If encryption in transit is required over DX, you run an IPsec VPN over the Direct Connect link (which AWS supports) or use MACsec on higher-capacity ports. Conversely, VPN encryption costs router CPU, and that cost shows up as throughput limits you discover under load.

What Does Direct Connect Actually Cost in Practice?

A single 1 Gbps port sits around USD 200–250 a month in port charges depending on region and partner, plus a lower per-GB data-transfer rate than internet egress. That sounds fine until you account for the full topology: production-grade designs want two ports in two different locations or at minimum two logical connections, which doubles the fixed cost before a single byte moves. Transit Gateway attachment and virtual interfaces add small charges. A realistic entry for a properly redundant DX setup is therefore in the USD 500–1,000/month range, against roughly USD 72/month for two VPN connections carrying the same traffic.

The break-even is not primarily financial, though. It appears when any of these become true: your hybrid traffic is sustained and data-transfer costs start to matter; latency variance is causing timeouts or replication lag; the VPN tunnels are consuming significant router CPU; or a regulator, customer contract or internal policy says the path must be private. Below that threshold, VPN is the rational choice and it is not close.

How Is the Latency Difference Real?

On a VPN between Mumbai and ap-south-1, expect single-digit to low double-digit milliseconds when the path is good, with tail latency that swings during peak hours and the occasional retransmission stall when a carrier path changes. On Direct Connect at the same sites, you will see tight, repeatable numbers — often a millisecond or two — with almost no tail variance.

For a batch file transfer nobody is waiting on, the difference is invisible. For Oracle replication, voice traffic, a trading-adjacent workload, or anything holding a long-lived connection with strict timeouts, the variance is what breaks things, not the average. This is also why p95 and p99 measurements matter more than means in any hybrid performance review.

# Provisioning a 1 Gbps hosted connection and its private virtual interface
aws directconnect create-connection 
  --name "mum-office-dx-1g" 
  --bandwidth 1Gbps 
  --location "MLNX123" 
  --provider-name "PartnerName" 
  --connection-type "hosted"

aws directconnect create-virtual-interface 
  --connection-id dxcon-0abc123def456 
  --virtualInterfaceName "to-prod-vpc" 
  --asn 65000 
  --addressFamily ipv4 
  --amazonAddress 169.254.10.1/30 
  --customerAddress 169.254.10.2/30 
  --routeFilterPrefixes 10.20.0.0/16 
  --virtual-interface-type "private"

Note the lead time implication in that command: creating the connection is instant, but the physical cross-connect behind it is ordered from a partner and scheduled by a data centre. Treat DX like procurement, not like configuration, when you plan a migration date.

The Cutover That Assumed DX Could Not Fail

A logistics company in Delhi NCR migrated its on-premises warehouse system to ap-south-1 in 2025 over a freshly installed Direct Connect. It went well, so they decommissioned the VPN tunnels to “simplify the design” — a decision that sounded defensible given DX was sold to them as more reliable than the internet.

Seven weeks in, a fibre cut in the building’s path took the port down for close to four hours. With the VPN gone there was no fallback, warehouse scanning went to a manual process for the afternoon, and the recovery conversation afterwards was uncomfortable: AWS documents state plainly that a single DX connection has no availability SLA, and the standard mitigation — keep an IPsec VPN as backup, or order redundant ports in different locations — had been on the original design but dropped in the simplification pass.

They restored VPN over the DX link the same week and now treat the pair as one design. The wider lesson applies to any hybrid decision: the redundancy question is separate from the transport question. Ask “how does this fail?” before asking “which is faster?” For the VPC-side plumbing that these connections feed into, the fundamentals are in AWS VPC Explained: Subnets, Route Tables, NAT and Flow Logs.

So Which Should You Choose?

Choose VPN when

You are starting out, traffic is modest or bursty, you need connectivity this week, or you are building a secondary path anyway. Two tunnels per connection across two edge devices give you more practical resilience for under USD 100 a month than most single-port designs give for five hundred.

Choose Direct Connect when

Traffic is sustained (roughly hundreds of gigabytes monthly and growing), latency variance causes real problems, replication or backup windows are tight, or a compliance requirement demands a private path. Also when your data-transfer-out bill over VPN has quietly become larger than the port would have cost — run the numbers before assuming DX is the expensive option.

Choose both when

You are running anything you would describe as production hybrid. VPN as backup over an active DX link is the pattern AWS itself recommends, and it is what the incident above forced into place.

One sizing note: evaluate where the traffic actually terminates. If your hybrid traffic is heading for multiple VPCs across accounts, Transit Gateway with DX Gateway attachment scales far better than a VPN connection per VPC, and the connection density problem disappears. Provisioning that network layer as code rather than by hand is the same discipline covered in Terraform vs AWS CDK vs CloudFormation.

Training Resources

Hybrid connectivity, BGP, Transit Gateway and the design trade-offs above are taught properly in SkilBrill AWS Networking Training. For the architecture context around when to buy which capacity, see AWS Advanced Architecture Training.

FAQ

What is the difference between AWS Direct Connect and a Site-to-Site VPN?

A VPN is an encrypted tunnel over the public internet — cheap, instant to create, variable latency. Direct Connect is a dedicated physical connection with consistent latency and higher throughput, but it takes weeks to provision, costs hundreds of dollars a month and is unencrypted by default.

Is Direct Connect more expensive than VPN?

On fixed cost, yes — roughly USD 200–250 a month for a 1 Gbps port versus about USD 36 for a VPN connection. On data transfer it is cheaper per GB, so at sufficient volume DX can cost less overall. Model both before deciding.

Is Direct Connect encrypted?

No. It is a private circuit, which prevents internet exposure but does not encrypt payloads. If encryption in transit is required, run IPsec VPN over the Direct Connect link or use MACsec on supported port speeds.

Does AWS Direct Connect have an SLA?

A single DX connection does not carry an availability SLA. Redundant connections across separate locations, or an IPsec VPN as a backup path, are how teams make the design resilient — AWS recommends keeping the VPN for exactly this reason.

When should a growing team move from VPN to Direct Connect?

When hybrid traffic is sustained and growing, when latency variance is causing timeouts or replication lag, or when a compliance rule requires a private path. Below that threshold, spend the money on redundant VPN tunnels first.

Written by SkilBrill Training Institute

October 15, 2026 · 9 min read