AWS Accelerated Site-to-Site VPN – AWS Transit Gateway, Single AWS Region - Hybrid Connectivity

AWS Accelerated Site-to-Site VPN – AWS Transit Gateway, Single AWS Region

This model is constructed of:

  • Single AWS Region.

  • AWS Managed Site-to-Site VPN connection with AWS Transit Gateway.

  • Accelerated VPN enabled.

Diagram showing AWS Managed VPN – AWS Transit Gateway, Single AWS Region

Figure 4 – AWS Managed VPN – AWS Transit Gateway, Single AWS Region

Connectivity model attributes:

  • Provide the ability to establish optimized VPN connections over the public internet by using AWS Accelerated Site-to-Site VPN connections.

  • Provide the ability to achieve higher VPN connection bandwidth by configuring multiple VPN tunnels with ECMP.

  • Can be used for connection from multiple of remote sites.

  • Offers automated failover with dynamic routing (BGP).

  • With AWS Transit Gateway connected to VPCs, all the connected VPCs can use the same VPN connections. You can also control the desired communication model among the VPCs, for more information refer to How Transit Gateways Work.

  • Offers flexible design options to integrate third-party security and SD-WAN virtual appliances with AWS Transit Gateway. See Centralized network security for VPC-to-VPC and on-premises to VPC traffic.

Scale considerations:

  • Up 50 Gbps of bandwidth with multiple IPsec tunnels and ECMP configured (each traffic flow will be limited to the maximum bandwidth per VPN tunnel).

  • Thousands of VPCs can be connected per AWS Transit Gateway.

  • Refer to the Site-to-Site VPN quotas for other scale limits, such as number of routes.

Other considerations:

  • The additional AWS Transit Gateway processing costs for data transfer between the on-premises data center and AWS.

  • Security groups of a remote VPC cannot be referenced in AWS Transit Gateway – this is supported by VPC peering, however.