On-premises Customer Gateway
Cloud / Knowledge library
AWS Site-to-Site VPN
Creates managed IPsec tunnels between AWS networks and customer gateways
Why learn AWS Site-to-Site VPN?
Teams use AWS Site-to-Site VPN to adopt site-to-site cloud VPN without building the complete underlying platform themselves.
The problem it solves
Connects private networks to cloud virtual networks through encrypted tunnels
Where it came from
AWS Site-to-Site VPN is Amazon Web Services's offering for site-to-site cloud VPN. Its closest catalog counterparts are Azure VPN Gateway and Google Cloud VPN; they address the same broad need but are not feature-for-feature identical.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Explain the main responsibility of AWS Site-to-Site VPN.
- Choose a workload that fits AWS Site-to-Site VPN.
- Identify one operational tradeoff of AWS Site-to-Site VPN.
- Compare AWS Site-to-Site VPN with Azure VPN Gateway.
- Compare AWS Site-to-Site VPN with Google Cloud VPN.
Documentation and sources
- AWS cloud services catalog (aws.amazon.com)
Connect the ideas
Alternatives
Real World Example
Secure Logistics Data Bridge
A regional logistics firm operating private on-premises warehouse management systems that must securely communicate with cloud-based inventory analytics platforms.
The business problem
The firm requires a persistent, encrypted connection between their local data center and the AWS VPC to synchronize sensitive inventory data without exposing traffic to the public internet.
How this topic solves it
AWS Site-to-Site VPN creates managed IPsec tunnels between the customer gateway and a virtual private gateway, ensuring that traffic is encrypted in transit and routed through a secure, private tunnel.
- Create a Customer Gateway resource in the AWS console representing the on-premises router's public IP address.
- Provision a Virtual Private Gateway and attach it to the target VPC.
- Configure the Site-to-Site VPN connection, selecting the previously created gateway resources.
- Download the vendor-specific configuration file and apply the IPsec tunnel settings to the local on-premises hardware.
- Update the VPC route tables to direct traffic destined for the on-premises network through the Virtual Private Gateway.
The flow of traffic from the local warehouse through the encrypted tunnel to the cloud analytics platform.
Transport medium
AWS VPN termination point
Cloud-based application network
- Warehouse Router → Encrypted IPsec Traffic → Public Internet
- Public Internet → Encrypted IPsec Traffic → Virtual Private Gateway
- Virtual Private Gateway → Internal VPC Routing → Inventory Analytics VPC
Expected business outcome
The logistics firm achieves a persistent, encrypted communication channel that allows internal applications to interact as if they were on the same local network, maintaining data integrity and security compliance.
Limitations and checks
The primary limitation is that Site-to-Site VPN traffic traverses the public internet, which can introduce variable latency compared to dedicated private connections. To check for latency issues, administrators should monitor the CloudWatch metrics for tunnel state and packet loss.