Instructor: Now let's talk about Direct Connect,
and you may also see it as DX in the exam.
So it provides a dedicated
private connection from the remote network into your VPC.
So you need to set up that Direct Connect connection
and it is using an AWS Direct Connect location.
You also need to set up
a virtual private gateway on your VPC side
to make the connectivity
between your on-premise data center and AWS.
The idea is that on the same connection
you can access both public resources
such as Amazon history and private resources,
such as EC2 Instances using the the public VIF
and the private VIF.
So what are the use cases for Direct Connect?
Well, you get increased bandwidth throughputs,
that means that if you're working with large data sets,
is going to be faster
because it doesn't go over the public internet,
and also you're going to have lower cost
because you're using a private connection.
Also, if you have connectivity issues
using the public internet,
we'll using Direct Connect
you get a more consistent network experience,
again because it is private.
So this is especially helpful
if you have applications using real time data feeds.
Finally, it supports hybrid environments
because you have connectivity
between your own premises data center and the cloud.
It supports both IPv4 four and IPv6.
So let's look at a diagram of Direct Connect.
So we have a region
and we want to connect it into our corporate data center.
So for this, we're going to commission
an AWS Direct Connect location,
their physical locations that you have to find
but it's all obviously on the website of AWS,
and there's going to be a Direct Connect endpoints,
and there's going to be a customer or partner router
that you have to rent from a customer or partner cage.
So you have two cages in this Direct Connect location,
and then on your on-premise data center,
you're going to set up a customer router with a firewall.
Now you're going to set up a private virtual interface,
so private VIF first to access your private resources
into your VPC.
So to do so, you set up the private VIF
in between all these locations
into a virtual private gateway.
And this virtual private gateway
is attached to your VPC.
And through the private VIF,
you are able to access your private subnets
with your EC2 Instances.
And as you can see,
all these things happen privately,
so you need to set up that connection manually,
it can take a month to set up,
but none of this goes over the public internet,
it is all a private connectivity.
The alternative is to connect to public services within AWS
such as Amazon Glacier, Amazon S3.
And for this, you're going to set up
a public virtual interface or public VIF.
And so it goes through the same path
but it doesn't connect into a virtual private gateway,
it connects directly into AWS.
So what if you want to connect
to one or more VPCs in different regions?
For this, you must use a Direct Connect gateway.
So we have an example
where we have two regions,
and they have two different VPC,
we have two different CIDRs
and we want to connect our on-premise data center
into both VPC.
So we're going to establish a Direct Connect connection,
then using the private VIF,
you're going to connect it to Direct Connect gateway.
And this gateway will have a private virtual interface
into a virtual private gateway
in the first region and another one in the second region.
So using the setup, we can start connecting to multiple VPCs
and multiple regions.
Okay, now let's discuss the connection types
for Direct Connects.
We have a dedicated connection,
it could be one gigabits per second
or 10 gigabits per second capacity,
and we get a physical ethernet port that is dedicated to us.
And first we need to make a request to AWS,
and then it will be completed
by an AWS Direct Connect partner.
Or we can get a hosted connection,
and they come in different flavors
such has 15 megabits per second, 500 megabits per second
up to 10 gigabits per second.
And again, we make connection requests
via via AWS Direct Connect Partners.
And then we can add capacity on demand,
so we can add or remove capacity on demand,
so it's a bit more flexible than a dedicated connection.
And so we can get one, two, five 10 gigabits available
at select locations.
And to set up either a dedicated or a hosted connection,
the lead times are often longer
than one month to establish a new connection.
So in the exam, they will ask you questions around,
hey we want you to transfer some data within a week
and we want it to be fast.
So an answer can not be Direct Connect
because Direct Connect takes
often more than one month to establish.
So you need to look into question
whether or not there's already a Direct Connect established,
and whether or not the time to transmit the data
is less or greater than one month.
Now, when you have a Direct Connect, there is no encryption.
So data is not encrypted
but it is private because it is a private connection.
And so if you want an encryption on top of it,
you can set up Direct Connect to be alongside a VPN
to provide IPsec encrypted private connection.
So it's good to get an extra level of security
but it's slightly more complex to put in place.
So to set up is to get the Direct Connect location,
but then on the connection,
you're going to set up a VPN connection on top of it,
to have encryption for your Direct Connect
and therefore all the traffic
between your corporate data sensor to AWS
is going to be encrypted.
Now, one last thing that can come up in the exam,
is around resiliency for Direct Connect.
So we have two modes of resiliency and architectures
and you need to know them both
because they will be coming up at the exam.
You have a high resiliency for critical workloads
where we set up multiple Direct Connects.
So we have two corporate data centers
and we have two different Direct Connect location,
and this gives us some redundancy.
So in the first case,
we have a private VIF here and we have a private VIF here.
And so here we get one connection and multiple locations,
and so if one of the Direct Connect location goes down,
then at least we have some backup
Direct Connect location somewhere else
and so this gives us high resiliency,
and this is good for critical workloads.
But if you want to get to maximum resiliency
for critical workloads
and I emphasize the word maximum
because it can come up in the exam,
then you're going to have to set up
again two Direct Connect locations,
but this time each Direct Connect location
will have two connections
independence to give you maximum resiliency.
So in this use case, we have four connections
across two locations, sorry, going into AWS.
And so a maximum resilience is achieved
by using separate connections,
terminating on separate devices in more than one location.
So that's it for Direct Connect.
I hope you liked this lecture,
and I will see you in the next lecture.