What Is AWS Direct Connect? Pricing With Examples, Setup, Partners and Locations, and Direct Connect vs Site-to-Site VPN

AWS Site-to-Site VPN and AWS Direct Connect both connect your office, data center or factory to your AWS VPCs privately, but they work differently. A Site-to-Site VPN is an encrypted IPsec tunnel over the public internet. You can set it up in an hour with the router you probably already have, and it costs $0.05 per hour per connection (about $36.50 a month) plus normal internet data transfer out ($0.09 per GB after the first 100 GB). Each tunnel carries up to 1.25 Gbps, or 5 Gbps with large bandwidth tunnels on a transit gateway. Direct Connect is a private fiber connection from your network to an AWS Direct Connect location that never touches the internet, so you get consistent latency and bandwidth from 50 Mbps to 400 Gbps. You pay port-hours (a dedicated 1 Gbps port is $0.30 an hour, about $219 a month; hosted 50 Mbps from a partner is $0.03 an hour) plus much cheaper data transfer out, $0.02 per GB from US Regions, and nothing for data in. It takes days to weeks to set up, and it isn't encrypted unless you add MACsec or a VPN on top. Short version: start with VPN; move to Direct Connect when you need steady performance, more than a few Gbps, or move enough data out of AWS that the cheaper $0.02 rate pays for the ports. Below: how each works, every price with worked examples, a side-by-side table, setup steps, resiliency designs, and how to use both together.

Ethan's client, the online furniture store, had opened a warehouse with its own small server room: an inventory system, label printers and a barcode scanner network that needed to talk to the order system in AWS. The first plan was to expose the inventory server to the internet "just for the AWS servers," which made Ethan wince. Jake, delivering a box of repaired tablets for the warehouse staff, asked the question this page answers: "Can't the warehouse just use the internet like everyone else? Why does it need a special connection to AWS?"

New to AWS networking? The cards below cover VPCs, data transfer pricing, Transit Gateway, on-premises migration and hybrid DNS, the pieces a connection to your office plugs into.

Why connect your network to AWS at all?

Most AWS workloads talk to the world over the internet, and that is fine for websites and public APIs. A private connection between your own network and your VPCs matters when systems on both sides need to talk to each other as if they were on one network, using private IP addresses, without exposing anything to the internet:

• Hybrid applications: an order system in AWS calling an inventory server in the warehouse, like Ethan's client.
• Migrations: moving servers and databases to AWS over weeks while both sides keep running; our migration guide covers the process.
• Staff access to internal systems in AWS from the office, without public endpoints.
• Directory and DNS: Active Directory domain controllers and DNS servers that span both sides.
• Bulk data: backups, analytics exports and media files moving in or out of AWS every day.

The alternative, putting internal servers on the internet with a firewall rule for "only AWS," is fragile: AWS address ranges are huge and shared by every customer, so "only AWS" means "anyone with an AWS account." A private connection keeps internal systems internal.

Jake: "So it's like a private hallway between the warehouse and the cloud, instead of shouting across the street?"

Ethan: "A VPN is a locked tube through the street. Direct Connect is your own private road. Both keep strangers out; the road is faster and steadier, and costs more."

How AWS Site-to-Site VPN works

A Site-to-Site VPN connection links a router or firewall in your network, the customer gateway device, to AWS with IPsec, the standard encrypted tunnel protocol that nearly every business router and firewall supports: Cisco, Fortinet, Palo Alto, pfSense, Juniper, MikroTik, Windows Server RRAS and many more.

• Two tunnels per connection. Every VPN connection has two tunnels to two different AWS endpoints, so AWS maintenance or a failure on one endpoint does not drop you. Configure both on your device.
• AWS side: virtual private gateway, transit gateway or Cloud WAN. A virtual private gateway attaches the VPN to one VPC; a transit gateway attaches it to a hub that connects many VPCs (and accounts); AWS Cloud WAN does the same at global scale.
• Routing: static or BGP. Static routes are simplest for one office; BGP (dynamic routing) lets the tunnels fail over automatically and exchange routes as networks change.
• Bandwidth: up to 1.25 Gbps per tunnel by default. Large bandwidth tunnels raise that to 5 Gbps per tunnel for VPNs attached to a transit gateway or Cloud WAN (not a virtual private gateway); both tunnels must use the same setting, the customer gateway needs a fixed public IP, and accelerated VPN is not supported with them. For more, combine several connections with ECMP on a transit gateway.
• Accelerated VPN (transit gateway only) sends the tunnels through AWS Global Accelerator's edge locations, so traffic enters the AWS network near your site instead of crossing the whole internet; useful for distant offices.
• Encrypted by design: everything in the tunnel is encrypted, so it is safe over the public internet.

The catch is the internet itself: latency and throughput vary with your provider's network and with congestion between you and AWS, which is fine for most business traffic and less so for latency-sensitive replication or very large, steady transfers.

How AWS Direct Connect works

Direct Connect is a physical, private network connection: a fiber-optic cable from your network to an AWS router at a Direct Connect location, which is a colocation data center where AWS has equipment. From there, traffic travels over AWS's private network to your Region. It never crosses the public internet, which is why performance is steady and predictable.

What Direct Connect is used for

• Data centers running alongside AWS: databases replicating between the two sides, applications split across both, and shared directory services, all needing steady latency.
• Large, regular data movement: nightly backups to S3, analytics extracts, media files and scientific datasets, where the $0.02 per GB rate and free inbound transfer matter.
• Migrations of whole data centers: moving hundreds of terabytes faster and more predictably than over the internet.
• Regulated workloads where policy says traffic must not cross the public internet.
• Latency-sensitive systems: trading, real-time manufacturing control, voice and video platforms, where jitter on an internet path causes visible problems.

How it works, end to end

Follow one request from a server in your data center to an EC2 instance in your VPC. The packet leaves your server for your router, which has learned through BGP that the VPC's address range is reachable over the Direct Connect link. Your router sends it, tagged with the virtual interface's VLAN, down the fiber (or the partner's circuit) to the Direct Connect location. There, AWS's router passes it onto AWS's own backbone network to your Region, through the Direct Connect gateway and transit gateway (or straight to the VPC's virtual private gateway), and into the subnet. The reply comes back the same way. At no point does it touch an internet service provider, which is where the consistency comes from: the path, the capacity and the distance are fixed.

Speed and latency: what to expect

Throughput is what you buy: a 1 Gbps port carries up to 1 Gbps in each direction, a hosted 200 Mbps connection up to 200 Mbps, without competing with other internet traffic. Latency depends mostly on physical distance (from your site to the Direct Connect location, then on to the Region), so a data center in the same metro as both sees a few milliseconds, while a site hundreds of miles from its location sees more. What Direct Connect removes is the variation: an internet VPN's round-trip time can swing with congestion through the day, while a Direct Connect path stays nearly flat. If your applications only need occasional bursts of a few hundred megabits and tolerate some variation, a VPN delivers similar results for far less.

Dedicated vs hosted connections

• Dedicated connection: a physical port on an AWS router reserved for you, at 1, 10, 100 or 400 Gbps. You (or your carrier) run a cross-connect cable to it in the Direct Connect location. Best for large companies, or anyone already in that data center.
• Hosted connection: a slice of a partner's connection, sold by an AWS Direct Connect Partner (telecom carriers and network providers), from 50 Mbps up to 25 Gbps. The partner handles the physical link; you get a connection in your account to accept. Best for small and mid-size companies, and anyone not in a Direct Connect location.

Virtual interfaces: what the connection reaches

A connection is just the pipe. You create virtual interfaces (VIFs) on it to reach things, each a VLAN with its own BGP session:

• Private VIF: reaches a VPC (through its virtual private gateway) using private IP addresses, or many VPCs across accounts and Regions through a Direct Connect gateway.
• Transit VIF: reaches one or more transit gateways through a Direct Connect gateway, the usual design when you have many VPCs.
• Public VIF: reaches AWS public services (S3, DynamoDB and other public endpoints, in all public Regions) over the private connection instead of the internet.

A Direct Connect gateway is a free, global object that lets one connection reach VPCs and transit gateways in many Regions and accounts. SiteLink, an optional feature, lets your own sites send traffic to each other over AWS's network through Direct Connect locations.

Requirements and encryption

• Your router must support BGP with MD5 authentication and 802.1Q VLANs, and single-mode fiber with the right optics for dedicated connections (for example 1000BASE-LX for 1 Gbps or 10GBASE-LR for 10 Gbps).
• Traffic is not encrypted by default. It is private, not encrypted. For encryption, turn on MACsec (on supported 10, 100 and 400 Gbps dedicated connections at select locations), or run a Site-to-Site VPN over the Direct Connect connection.
• Jumbo frames help large transfers: up to 9001 bytes MTU on private VIFs and 8500 bytes on transit VIFs, if every device on the path supports them.

Direct Connect partners and locations

Direct Connect locations are colocation data centers, many run by companies such as Equinix and Digital Realty, where AWS has routers. Each location is associated with a nearby AWS Region, and through a Direct Connect gateway it can reach VPCs in other Regions too. You find the current list, with the port speeds each location offers, in the Direct Connect console when you create a connection.

If your equipment is not in one of those buildings, a Direct Connect Partner (a telecom carrier or network provider in the AWS Partner Network) brings the connection to you: they run a circuit from your office or data center to a Direct Connect location and sell you either a hosted connection or a hosted virtual interface on their link. Questions worth asking a partner before you sign:

• Which Direct Connect locations do you reach from my building, and how long is installation?
• Which speeds can you offer as hosted connections, and can I upgrade later without a new circuit?
• What is your monthly fee, separate from the AWS port-hours, and what is the contract length?
• Can you provide diverse paths to two different locations for resiliency?
• Do you support MACsec, jumbo frames and BFD on the circuit?

Direct Connect gateway vs transit gateway

The two names sound alike and do different jobs, and most larger networks use both:

• A Direct Connect gateway is a free, global attachment point for your Direct Connect virtual interfaces. It connects one VIF to virtual private gateways or transit gateways in any Region (except China) and any account. It does not route traffic between VPCs.
• A transit gateway is a regional router that connects many VPCs, VPNs and Direct Connect gateways, and routes between them, billed per attachment-hour and per GB processed.

The common design: your Direct Connect connection carries a transit VIF to a Direct Connect gateway, which is associated with a transit gateway in each Region you use; every VPC attaches to its Region's transit gateway. One physical connection then reaches every VPC, in every account and Region, with routing controlled in one place.

Using one connection across many accounts

Companies with many AWS accounts rarely buy a connection per account. Instead, the networking account owns the connection and a Direct Connect gateway, and other accounts either attach their VPCs to a shared transit gateway (shared with AWS Resource Access Manager), or send an association proposal from their virtual private gateway or transit gateway to the Direct Connect gateway, which the owner accepts. You can also create hosted virtual interfaces on your connection for other accounts. Data transfer out is billed to the account that owns the resource sending the traffic, so costs stay with each team.

Direct Connect vs Site-to-Site VPN, side by side

Pricing, with worked examples

Site-to-Site VPN pricing (US East)

• Standard connection (tunnels up to 1.25 Gbps): $0.05 per connection-hour while it is provisioned, about $36.50 a month.
• 5 Gbps connection (large bandwidth tunnels): $0.60 per connection-hour, about $438 a month.
• Accelerated VPN: plus two Global Accelerators per connection at $0.025 an hour each, and data transfer premium fees.
• Transit gateway attachment, if you attach the VPN to a transit gateway: $0.05 per attachment-hour, plus transit gateway data processing.
• Data transfer out from AWS over the VPN: standard internet rates, with the first 100 GB a month free, then $0.09 per GB for the first 10 TB and $0.085 per GB for the next 40 TB. Data in is free.
• For many small sites, AWS also offers a Site-to-Site VPN Concentrator at $1.95 an hour plus $0.01 an hour per connected site.

Direct Connect pricing

• Dedicated port-hours (all locations except Japan): 1 Gbps $0.30, 10 Gbps $2.25, 100 Gbps $22.50, 400 Gbps $85.00 per hour.
• Hosted port-hours: 50 Mbps $0.03, 100 Mbps $0.06, 200 Mbps $0.08, 300 Mbps $0.12, 400 Mbps $0.16, 500 Mbps $0.20, 1 Gbps $0.33, 2 Gbps $0.66, 5 Gbps $1.65, 10 Gbps $2.48, 25 Gbps $6.20 per hour.
• Data transfer in: $0.00 per GB everywhere.
• Data transfer out: from contiguous US Regions to a US, Canadian or European Direct Connect location, $0.02 per GB; other combinations cost more (for example about $0.049 to Japan and $0.06 to India from US Regions).
• Direct Connect gateway: no extra charge.
• Not on the AWS bill: the circuit from your building to the Direct Connect location (your carrier), the cross-connect fee in the data center, and the partner's own charges for hosted connections. These are often larger than the AWS port-hours.

Example 1: a warehouse on VPN

Ethan's client: one VPN connection to a virtual private gateway, 200 GB a month going from AWS to the warehouse (inventory updates, label files).

• Connection: $0.05 x 730 hours = $36.50
• Data out: first 100 GB free, then 100 GB x $0.09 = $9.00
• Total: about $45.50 a month

Example 2: a small hosted Direct Connect

A 500 Mbps hosted connection from a partner, 2 TB a month out of AWS:

• Port: $0.20 x 730 = $146.00
• Data out: 2,048 GB x $0.02 = $40.96
• AWS total: about $187 a month, plus the partner's circuit fee

Example 3: when Direct Connect pays for itself

A media company moves 50 TB a month out of AWS to its own systems. Over the internet (VPN or not), data out costs roughly 10 TB x $0.09 plus 40 TB x $0.085, about $4,400 a month. Over Direct Connect at $0.02 per GB, the same 51,200 GB costs $1,024. Even with a dedicated 10 Gbps port ($2.25 x 730 = $1,642.50) the AWS side is about $2,670, saving around $1,700 a month before circuit fees, with steadier performance. The more data you move out, the stronger the case.

Example 4: maximum resiliency for a data center

Two Direct Connect locations, two dedicated 10 Gbps connections at each (four ports), US East: 4 x $2.25 x 730 = $6,570 a month in port-hours, plus data out (400 TB at $0.02 is about $8,192). That is the price of the highest-availability design, and of carrying very large volumes privately.

Data transfer rules across AWS are covered in our data transfer pricing map, including why data in is free and data out is not.

Estimating your own monthly bill

You can estimate either option in five minutes with three numbers: hours (730 in a month), the price per hour of what you run, and the gigabytes you send out of AWS each month.

• Site-to-Site VPN: connections x hourly rate x 730, plus (GB out minus 100 free) x internet rate, plus transit gateway attachments and data processing if you use one.
• Direct Connect: ports x port-hour rate x 730, plus GB out x Direct Connect rate for your Region and location, plus the partner's or carrier's monthly fee, plus the data center cross-connect fee for dedicated ports.

Then compare at your real traffic. A rough break-even for data out alone: each terabyte moved over Direct Connect instead of the internet saves about $70 (1,024 GB x the $0.07 gap between $0.09 and $0.02). A hosted 500 Mbps connection at about $146 a month in port-hours pays for itself on data savings at roughly 2 TB a month out, before partner fees; with partner fees included, the crossover is usually a few terabytes higher. Below that, a VPN is cheaper, and the decision rests on performance and policy rather than price. The AWS Pricing Calculator models both services if you want an itemized estimate to share with finance.

Set up a Site-to-Site VPN, step by step

1. Collect your side's details: the public IP address of your router or firewall, whether it supports BGP (and its ASN if so; use a private ASN such as 65000 if you have none), and your office network ranges (for example 192.168.10.0/24).
2. Create a customer gateway in the VPC console (Virtual private network > Customer gateways) with that IP and ASN.
3. Create the AWS side: a virtual private gateway attached to your VPC, or use an existing transit gateway if you have several VPCs.
4. Create the Site-to-Site VPN connection between the two, choosing dynamic (BGP) or static routing; for static, enter your office ranges. Choose standard or large bandwidth tunnels (transit gateway only).
5. Download the configuration for your device's vendor and model from the connection's page; AWS generates a ready-made config with both tunnels, keys and settings.
6. Apply it to your router or firewall, configuring both tunnels.
7. Route traffic on the AWS side: turn on route propagation from the virtual private gateway in the VPC's route tables (or add static routes to the office ranges), or associate and propagate on the transit gateway route table.
8. Allow the traffic: security groups and network ACLs in AWS must allow the office ranges; your firewall must allow the VPC ranges.
9. Test from both sides with a ping or a connection to a real service, and check both tunnels show UP in the console.
10. Monitor the TunnelState CloudWatch metric with an alarm, so you hear about a down tunnel before users do.

The usual reasons a new VPN does not pass traffic: only one tunnel configured, route propagation not turned on, overlapping IP ranges between the office and the VPC, or a security group missing the office range. For DNS between the office and AWS, see our Route 53 Resolver guide; if ping tests fail while other traffic works, our ICMP and security group guide explains why.

Jake: "That's it? One afternoon and the warehouse is on the same network as the cloud?"

Ethan: "One afternoon, two tunnels, and an alarm if either goes down. The inventory server stopped being on the internet that evening."

Set up Direct Connect, step by step

Hosted connection (through a partner)

1. Choose a Direct Connect Partner that serves your building and a Direct Connect location near your Region.
2. Order the connection from the partner at the speed you need, giving your AWS account ID.
3. Accept the hosted connection in the Direct Connect console when it appears in your account. AWS port-hour billing for it starts once you accept it.
4. Create a virtual interface: private (one VPC), transit (transit gateways through a Direct Connect gateway) or public (AWS public services), with VLAN, BGP ASN and authentication key.
5. Configure BGP on your router (or let the partner do it), and confirm the BGP session is up.
6. Route and test: propagate routes into VPC route tables or the transit gateway, then test from both sides.

Dedicated connection

1. Request a dedicated connection in the Direct Connect console at your chosen location and port speed.
2. Download the LOA-CFA (Letter of Authorization and Connecting Facility Assignment) once AWS provisions the port.
3. Order the cross-connect from the data center operator with the LOA-CFA, and a circuit from your carrier to the location if you are not already there.
4. Check the link comes up (layer 1 and 2), then create virtual interfaces and BGP sessions as above.
5. Turn on MACsec if you need encryption on a supported port.

When it does not come up: common Direct Connect problems

• Connection up, virtual interface down: usually a layer 2 mismatch: the wrong VLAN ID on your router, 802.1Q not passed by an intermediate device, or an auto-negotiation setting that disagrees with AWS's port.
• VIF up, BGP not established: a typo in the peer IP addresses, the ASN or the MD5 authentication key, or a firewall blocking TCP port 179 between the BGP peers.
• BGP up, no traffic: routes are not propagated into the VPC route tables or the transit gateway route table, or security groups and network ACLs do not allow your on-premises ranges.
• BGP session drops after you add networks: private and transit virtual interfaces accept a limited number of prefixes from you (100); advertise summarized routes instead of every subnet.
• Traffic takes the VPN instead of Direct Connect: check that both advertise the same prefixes; a more specific prefix on the VPN wins over a broader one on Direct Connect.

Plan the timeline realistically: a hosted connection over a partner's existing circuit can be live in days; a new dedicated connection that needs a carrier circuit to a data center often takes weeks or months. Run a VPN in the meantime.

Resiliency: how many connections you need

A single Direct Connect connection is a single point of failure: one fiber cut or one device failure, and you are offline. There are three standard designs:

• Development and test: one connection at one location, often with a VPN as backup. Fine for non-critical workloads.
• High resiliency: one connection at each of two Direct Connect locations, so a location failure does not take you down.
• Maximum resiliency: two connections at each of two locations, on separate devices, for critical production workloads.

The Direct Connect console's Resiliency Toolkit walks you through ordering connections for each model, and it is worth using even if you buy through a partner. For Site-to-Site VPN, the two built-in tunnels cover AWS-side failures; for your side, consider two customer gateway devices and two internet providers, each with its own VPN connection.

The Direct Connect SLA

Direct Connect has a service level agreement whose availability commitments depend on how resilient your design is: the higher commitments apply to configurations with connections at more than one Direct Connect location, built along the high and maximum resiliency models. A single connection at a single location is the design most exposed to an outage, so treat it as development-grade or pair it with a VPN backup. Read the current SLA terms for the exact percentages and service credits before you promise availability numbers to your own customers.

Security on Direct Connect

• Private, not encrypted: your traffic is isolated from the internet on dedicated or partner circuits, but readable by anyone with physical access to the path. Add MACsec (layer 2 encryption between your router and AWS's) or IPsec VPN over Direct Connect when your data or your auditors require encryption in transit.
• BGP authentication: every virtual interface uses an MD5 authentication key for its BGP session; keep it secret and rotate it with your router changes.
• Least-reachable routing: advertise only the prefixes that need to reach AWS, and filter what you accept, so a mistake on one side does not route unexpected traffic over the link.
• Security groups and network ACLs still apply inside AWS; a private path is not permission to reach everything.

Monitoring the link

Direct Connect publishes CloudWatch metrics for connections and virtual interfaces, including ConnectionState (up or down), bits and packets per second in each direction, and errors. Set alarms on ConnectionState and on BGP status, and on egress throughput approaching your port size, so you know before users notice. For VPNs, the matching metric is TunnelState. VPC Flow Logs show which on-premises addresses are talking to which resources; our flow logs guide shows how to read them.

Direct Connect vs Azure ExpressRoute, Google Cloud Interconnect and PrivateLink

• Azure ExpressRoute is Microsoft's equivalent of Direct Connect: a private circuit from your network to Microsoft's, through connectivity providers or directly at peering locations. A notable difference in pricing models: ExpressRoute offers metered plans (pay per GB out) and unlimited data plans at a higher fixed price, while Direct Connect always charges port-hours plus per-GB data out.
• Google Cloud Interconnect comes as Dedicated Interconnect (your own physical connection, like a dedicated Direct Connect) and Partner Interconnect (through a provider, like a hosted connection).
• Multi-cloud: companies on several clouds often buy connections to each from the same colocation facility, or use a network provider that links them; AWS also offers private interconnects with other clouds in some locations. The design ideas (two locations, BGP, encryption on top) carry over directly.
• AWS PrivateLink is a different tool: it connects VPCs to services (AWS services or your own) privately inside AWS through interface endpoints. It does not connect your office to AWS by itself, but you can reach PrivateLink endpoints over Direct Connect or a VPN, which is how on-premises systems call AWS services privately. Our VPC endpoint guide covers PrivateLink pricing.

Using both: VPN as a backup, and VPN over Direct Connect

Many companies use both services together:

• Direct Connect primary, VPN backup: traffic normally flows over Direct Connect; if it fails, BGP shifts traffic to the VPN automatically. AWS prefers Direct Connect routes over VPN routes for the same prefixes, so the VPN only carries traffic when Direct Connect is down. This gives you most of the resiliency of a second Direct Connect location for about $37 a month.
• VPN over Direct Connect: run IPsec tunnels across a Direct Connect connection (over a public VIF, or a transit VIF with private IP VPN to a transit gateway) to get encryption with Direct Connect's steady performance, when MACsec is not available.
• VPN first, Direct Connect later: start a migration on VPN the same week, order Direct Connect in parallel, and switch when the circuit is ready.

With a transit gateway as the hub, both connection types attach to the same routing table, and every VPC behind it can use whichever link is up.

Site-to-Site VPN vs Client VPN

A common confusion: Site-to-Site VPN connects whole networks (an office router to AWS); AWS Client VPN connects individual people (a laptop running the VPN client) to AWS, for remote staff. Client VPN costs $0.10 an hour per subnet association on the endpoint plus $0.05 an hour per active connection, so ten people connected for an hour cost $0.60 including the endpoint. If your staff work from home and need to reach private systems in AWS, Client VPN (or a zero-trust option such as AWS Verified Access) is the tool; our Client VPN DNS guide covers its most common issue.

The two often work together. Staff at the office reach AWS over the Site-to-Site VPN without running any client; staff at home connect with Client VPN to an endpoint in the VPC, and from there reach the same systems. Client VPN authenticates people with Active Directory, a SAML identity provider or certificates, which a Site-to-Site VPN does not do: once the office router is connected, everything on the office network can reach AWS, subject to your security groups. For a five-person office that is fine; for a company where access should follow the person rather than the building, combine the office VPN with per-user controls or move to an identity-aware option.

Which one do you need?

• A branch office or a small data center, normal business traffic: Site-to-Site VPN.
• You need it working this week: Site-to-Site VPN, whatever you plan long-term.
• Steady throughput above a few Gbps, or latency-sensitive replication: Direct Connect.
• Moving tens of terabytes out of AWS every month: Direct Connect, for the $0.02 per GB rate.
• Compliance requires traffic to stay off the internet: Direct Connect (with MACsec or VPN over Direct Connect if encryption is also required).
• Critical production depending on the link: Direct Connect at two locations, or Direct Connect plus a VPN backup.
• Remote workers, not offices: Client VPN or Verified Access, not Site-to-Site.

For Ethan's client, the answer was a Site-to-Site VPN from the warehouse's existing firewall to a virtual private gateway: $45 a month, live the same afternoon. When a larger client later needed to send 30 TB of photos a month to its print plant, Ethan priced a hosted Direct Connect and the data transfer savings paid for the port in the first month.

Frequently asked questions

Three months on, the warehouse VPN had gone down once, for eleven minutes, during the internet provider's maintenance window. The CloudWatch alarm emailed Ethan, the second tunnel had stayed up through most of it, and the label printers never stopped. The owner asked whether they needed "the fiber thing." Ethan showed him the bill, $45 a month, and the traffic graph, which barely reached 2 percent of the tunnel's capacity. "Not yet," he said. "When the second warehouse opens, we'll talk."

Revision note. Written October 21, 2026. Prices are US East list prices on that date. We will update this page when Direct Connect or Site-to-Site VPN prices or features change.