Hybrid Connectivity: VPN and Direct Connect

AWS Cloud & DevOps Engineering · Lesson 51 · Advanced Platforms and Networking

Lesson Overview

TechLearningPro still runs identity directories, content rendering farms, and compliance archives in colocation and campus data centers. Learners expect cloud APIs to reach those systems privately and reliably. AWS Site-to-Site VPN builds encrypted tunnels over the internet (or over Direct Connect when designed that way) between customer gateways and virtual private gateways or Transit Gateway. AWS Direct Connect provisions dedicated connectivity from your network to AWS via partner or AWS locations, using virtual interfaces (VIFs)—public, private, and transit—to reach public AWS prefixes or VPC/TGW networks. This lesson compares VPN vs Direct Connect concepts, routing and resilience patterns, and hybrid DNS caveats (Resolver outbound/inbound, conditional forwards colliding with PrivateLink Private DNS from lesson 50)—without inventing porting speeds as SLAs or fabricating API names.

Prior: multi-account networking (49), endpoints/DNS (50). Next: AWS Transit Gateway and Network Architecture where hybrid attachments often terminate. Tag Project=tlp-lesson51. VPN and DX have ongoing costs—budgets first; tear down lab VPNs; never order real DX ports for a classroom whim without Finance.

Learning Objectives

1. Explain when hybrid connectivity is justified versus redesigning for cloud-native.
2. Describe Site-to-Site VPN components: CGW, VGW/TGW attachment, tunnels, IPsec.
3. Contrast VPN over internet vs VPN as encryption overlay on DX.
4. Explain Direct Connect physical connectivity concepts and LOA-CFA process at a high level.
5. Differentiate private, public, and transit VIFs conceptually.
6. Design dual-tunnel VPN resilience and multi-DX / VPN backup patterns.
7. Reason about BGP versus static routing trade-offs at a conceptual level.
8. Identify MTU/MSS and asymmetric routing failure modes.
9. Document hybrid DNS pitfalls with Route 53 Resolver and on-prem forwards.
10. Place hybrid attachments in a Network Hub account landing zone.
11. Estimate qualitative cost drivers (VPN connection hours, DX port hours, data transfer)—verify live pricing.
12. Plan failover tests without assuming instantaneous BGP convergence myths.
13. Secure hybrid paths (encryption expectations, route least privilege).
14. Troubleshoot UP/DOWN tunnel states and missing routes.
15. Write ADR: VPN-only vs DX+VPN for TechLearningPro phases.
16. Prepare interview answers with clear component vocabulary.
17. Avoid treating DX as automatic security boundary without controls.
18. Clean up lab VPN connections; leave budgets on.

Prerequisites

• VPC routing basics; lesson 50 DNS awareness; lesson 48 Network Hub placement.
• Lab may be design-only if DX hardware is unavailable—still produce failover test plans.
• Budget alerts; change control for anything touching production hybrid.

Detailed Core Concepts

Why hybrid exists

Not everything migrates on day one: latency to campus labs, licensed appliances, mainframe grades pipelines, or legal holds on tape archives. Hybrid lets cloud apps reach on-prem APIs—and vice versa—under controlled routing.

Site-to-Site VPN

Customer gateway (your device/public IP) + AWS side (virtual private gateway attached to a VPC, or Transit Gateway VPN attachment). Two tunnels per connection for AZ resilience on AWS side. IKE/IPsec parameters must match. Internet path variability means jitter—acceptable for many admin/API uses; scrutinize for synchronous DB replication.

Direct Connect

A dedicated network path to AWS. You (or a partner) provision connectivity at a DX location. Private VIF to a VGW for VPC access; transit VIF to Transit Gateway (common in modern hubs); public VIF for public AWS service prefixes over DX. DX improves consistency versus internet VPN but is not magical security—still combine with encryption and firewalls as required by policy.

Resilience patterns

• Dual VPN tunnels (baseline).
• Dual DX connections in diverse locations/devices.
• DX primary + VPN backup (or active/active with care).
• Per-Region hybrid attachments for multi-Region apps (complexity rises).

Routing

BGP is common for DX and dynamic VPN. Advertise only needed prefixes; prefer summarization; avoid becoming a transit AS accidentally. Static routes appear in simpler VPN labs. Overlapping CIDRs between campus and VPC destroy hybrid dreams—plan IPAM early.

Hybrid DNS caveats

On-prem resolvers may forward amazonaws.com incorrectly, bypassing VPC Private DNS for interface endpoints. Split-horizon for internal.tlp can blackhole if PHZ not associated or Resolver rules mis-ordered. Lesson 50 Private DNS works inside VPC; hybrid clients need Resolver inbound/outbound endpoints and carefully tested rules—verify current Route 53 Resolver docs. Never assume “DX makes DNS private automatically.”

Architecture and Design Diagrams

mermaidCopy
flowchart LR
  Campus[TechLearningPro campus DC]
  CGW[Customer gateway]
  Inet[Internet]
  VPN[Site-to-Site VPN tunnels]
  DX[Direct Connect]
  VIF[Transit / Private VIF]
  TGW[Transit Gateway]
  VPC[App VPCs]

  Campus --> CGW
  CGW --> Inet --> VPN --> TGW
  Campus --> DX --> VIF --> TGW
  TGW --> VPC

mermaidCopy
flowchart TB
  Query[On-prem DNS query]
  Fwd[Conditional forwarder]
  R53in[Resolver inbound]
  PHZ[Private hosted zone]
  Bad[Forward amazonaws.com wrongly]
  Pub[Public resolution path]

  Query --> Fwd --> R53in --> PHZ
  Query --> Bad --> Pub

Technical Explanation

VPN establishment flow

1. Configure CGW with AWS-provided outside IPs and pre-shared keys / certificate options per current VPN options.
2. Tunnels negotiate IKE then IPsec; monitor TunnelState metrics.
3. Routes propagate to VPC/TGW route tables as designed.
4. Security groups and NACLs still apply to instances—VPN is not a SG bypass.

DX provisioning reality

Lead times involve carriers/partners, cross-connects, and LOA-CFA paperwork. Classroom ADRs should phase: start VPN, plan DX when traffic/SLA justifies. Do not invent week counts as AWS guarantees—use partner quotes.

Transit VIF + TGW

Modern multi-account landing zones often terminate hybrid on TGW in Network Hub (lesson 52). Spokes attach VPCs; on-prem prefixes propagate per TGW route tables with segmentation (prod vs sandbox).

Encryption on DX

DX private connectivity is not a substitute for encryption requirements. Many enterprises run VPN/MACsec patterns over DX—confirm current AWS DX MACsec and VPN-on-DX options in docs before mandating a design.

MTU and performance

DX and VPN MTU differences cause PMTUD black holes. Set TCP MSS clamping on routers when needed. Test large transfers deliberately.

Security model

Treat hybrid as extending your threat model: on-prem compromise can route toward cloud CIDRs if routes and SGs allow. Use firewall inspection (tease lesson 52), least-prefix advertisement, and deny sandbox↔on-prem as default.

Cost honesty

VPN connection hours, DX port hours, data transfer outbound over DX vs internet—look up current pricing. Idle DX ports hurt FinOps. Lab VPNs left up over weekends add up.

Observability

CloudWatch metrics for VPN tunnels; DX connection health; on-prem monitoring of BGP sessions. Alarm on tunnel DOWN; runbooks for failover.

Practical Implementation or Design Walkthrough

Problem

Create a hybrid topology design and failover test plan for TechLearningPro (VPN now, DX later) including DNS caveats.

Steps

1. Budget; tag Project=tlp-lesson51.
2. CIDR plan: no overlap campus ↔ cloud.
3. Draw VPN dual-tunnel to TGW (or VGW for simple lab).
4. Write failover test plan: disable tunnel 1, verify traffic; restore; document RTO expectations as measured, not marketing.
5. DNS appendix: list domains resolved where; forbid blanket amazonaws.com forwards; test PrivateLink names from on-prem jump host design.
6. ADR phase 1 VPN / phase 2 DX + transit VIF.
7. If lab-capable: create Site-to-Site VPN to a software CGW; prove ICMP/HTTPS; destroy after.
8. Cleanup; budgets on.

Enterprise Real-World Scenarios

Overlapping 10.0.0.0/8

Campus and VPC both used giant RFC1918. Hybrid blocked until cloud renumbered spokes—IPAM is a landing zone prerequisite.

VPN-only exam week

Internet brownout degraded on-prem grading appliance connectivity. Postmortem: DX project accelerated; short-term caching degraded mode (lesson 46 continuity).

DNS blackhole

Forwarded all AWS domains on-prem; interface endpoint Private DNS never used; apps broke when public egress blocked. Fixed Resolver rules.

Asymmetric routing

Active/active DX without symmetric firewall state. Connections failed randomly. Moved to primary/backup with clear preferences.

Accidental transit

On-prem advertised default route into TGW; sandboxes reached internet via campus. Fixed route table segmentation.

Best Practices

1. Dual tunnels minimum for VPN.
2. Diverse DX locations for production critical paths.
3. VPN backup for DX when policy allows.
4. Advertise least prefixes.
5. Solve CIDR overlap before cabling.
6. Test failover quarterly.
7. Design hybrid DNS deliberately; document resolution order.
8. Terminate hybrid in Network Hub.
9. Encrypt per compliance needs even on DX.
10. Alarm tunnel/BGP down.
11. MSS/MTU hygiene.
12. FinOps review idle DX/VPN.
13. Segment sandbox from on-prem.
14. Change-control routing changes.
15. Verify all option names in current AWS docs.

Common Mistakes and Anti-Patterns

1. Single tunnel VPN in production.
2. Assuming DX equals encrypted/authenticated app traffic.
3. Overlapping CIDRs.
4. Blanket DNS forwards for AWS domains.
5. No failover test—only theoretical diagrams.
6. Advertising default routes into cloud.
7. Leaving lab VPNs billed forever.
8. Inventing DX port speeds as course “facts.”
9. Ignoring SG rules after VPN is UP.
10. Mixing prod and sandbox in one TGW route table with on-prem.

Troubleshooting and Design Review

Interview Questions and Answers

Q1: VPN vs DX? A: VPN encrypts over internet (flexible, variable); DX dedicated connectivity (consistent, lead time/cost)—often combined.
Q2: Two tunnels? A: AWS AZ resilience for the VPN connection.
Q3: Private vs transit VIF? A: Private to VGW/VPC patterns; transit to TGW—confirm current use cases in docs.
Q4: Public VIF? A: Access public AWS prefixes over DX.
Q5: Why BGP? A: Dynamic failover and prefix exchange at scale.
Q6: Hybrid DNS risk? A: Mis-forwarding bypasses VPC Private DNS/PHZ.
Q7: Security of DX? A: Physical path control ≠ app security; still authz/encrypt.
Q8: Backup pattern? A: DX primary + VPN secondary common.
Q9: Overlap symptom? A: Blackhole or asymmetric weirdness—renumber.
Q10: Where terminate? A: Network Hub TGW in landing zones.
Q11: MTU issue sign? A: Small packets work, large fail.
Q12: Metrics? A: TunnelState, DX connection health—verify names.
Q13: When VPN enough? A: Lower volume, early hybrid, or backup.
Q14: LOA-CFA? A: Authorization paperwork for cross-connect—high level.
Q15: Link to PrivateLink? A: Hybrid clients still need correct DNS to use endpoints.

Hands-On Exercises

Exercise: Hybrid topology and failover test plan

Deliverable: diagrams, CIDR plan, VPN parameter checklist (doc-cited), failover script/runbook, DNS caveats appendix, ADR, budget, cleanup.

Challenge ADR

Constraint: RPO/RTO for on-prem grading appliance reachability during exam windows. Propose DX+VPN with measured failover drills and degraded UX flag.

Lab evidence checklist

Diagrams; tunnel metrics or design-only sign-off; DNS test plan; destroy proof for lab VPN.

Narrative: the forwarder that ate PrivateLink

Campus IT forwarded *.amazonaws.com to public resolvers “for speed.” Cloud apps on Direct Connect still broke endpoint DNS. Joint runbook fixed conditional forwards.

Continuity

Next: AWS Transit Gateway and Network Architecture.

Deep dive: certificate-based VPN auth awareness

Some designs use private certificates instead of PSKs—verify current Site-to-Site VPN authentication options in AWS docs.

Deep dive: Link aggregation / LAG concepts

DX LAG for bandwidth/resilience—conceptual only; partner constraints apply; verify docs.

Deep dive: security group strategy for hybrid clients

On-prem prefix lists as SG sources; avoid 0.0.0.0/0 just because VPN exists.

Extended enterprise scenario: campus Wi-Fi voice to cloud

Not every campus flow belongs on DX; classify traffic: control plane vs bulk content vs internet SaaS.

Extended enterprise scenario: DR Region hybrid

Secondary Region VPN for DR drills (lesson 45); document which prefixes advertise when.

Extended practice scenario 1 — 51 hybrid connectivity vpn and direct connect

Draw dual-tunnel VPN to TGW for TechLearningPro Network Hub; label CGW and tunnels.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 2 — 51 hybrid connectivity vpn and direct connect

Write failover test plan with measurable success criteria (not vibes).

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 3 — 51 hybrid connectivity vpn and direct connect

CIDR overlap detection worksheet between campus and all cloud spokes.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 4 — 51 hybrid connectivity vpn and direct connect

DNS caveat poster: forbidden blanket AWS domain forwards; recommended pattern.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 5 — 51 hybrid connectivity vpn and direct connect

Compare VPN-only vs DX+VPN phases in ADR with FinOps qualitative costs.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 6 — 51 hybrid connectivity vpn and direct connect

If lab allows: bring up Site-to-Site VPN; screenshot TunnelState; destroy after.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 7 — 51 hybrid connectivity vpn and direct connect

BGP vs static decision table for a small campus.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 8 — 51 hybrid connectivity vpn and direct connect

MTU/MSS troubleshooting checklist.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 9 — 51 hybrid connectivity vpn and direct connect

Prefix advertisement policy: prod on-prem only, deny sandbox.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 10 — 51 hybrid connectivity vpn and direct connect

Alarm design for tunnel DOWN to on-call.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 11 — 51 hybrid connectivity vpn and direct connect

Public vs private vs transit VIF explain-out loud teach-back.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 12 — 51 hybrid connectivity vpn and direct connect

Encryption-on-DX options research with doc links only.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 13 — 51 hybrid connectivity vpn and direct connect

Asymmetric routing tabletop with firewall state.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 14 — 51 hybrid connectivity vpn and direct connect

Map hybrid termination to lesson 48 Network Hub OU.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 15 — 51 hybrid connectivity vpn and direct connect

Data transfer pricing footnote discipline—date the pricing page.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 16 — 51 hybrid connectivity vpn and direct connect

Resolver inbound/outbound sketch for internal.tlp.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 17 — 51 hybrid connectivity vpn and direct connect

Change ticket template for advertising a new on-prem prefix.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 18 — 51 hybrid connectivity vpn and direct connect

Exam-week runbook: VPN degraded mode communications.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 19 — 51 hybrid connectivity vpn and direct connect

Inventory idle VPN connections in lab accounts.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 20 — 51 hybrid connectivity vpn and direct connect

Peer-review a design that uses single tunnel only—reject it.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 21 — 51 hybrid connectivity vpn and direct connect

Security review: SG sources using on-prem prefix lists.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 22 — 51 hybrid connectivity vpn and direct connect

Document LOA-CFA high-level steps from AWS DX docs.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 23 — 51 hybrid connectivity vpn and direct connect

Budget pre-check before any DX discussion with partners.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 24 — 51 hybrid connectivity vpn and direct connect

Cleanup sworn list for lab VPN/CGW resources.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 25 — 51 hybrid connectivity vpn and direct connect

Dress rehearsal: diagram + failover plan + DNS appendix + ADR + teach-back.

In a timed drill for hybrid VPN and Direct Connect design, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: topology diagrams, failover plans, DNS appendix, ADR, cleanup proof, and destroy confirmation for any lab resources.

Discuss how this lesson connects to PrivateLink DNS (50), TGW architecture (52), DR (45), landing zone Network Hub (48). List two failure modes you simulated or observed (tunnel DOWN; DNS blackhole from bad forwarders), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Compliance evidence pack for auditors / Finance

Hybrid architecture ADR; failover test records; encryption policy; prefix advertisement policy; DX contracts (redacted); budget approvals; DNS design.

Glossary drill

Site-to-Site VPN; customer gateway; virtual private gateway; Transit Gateway VPN attachment; IPsec; Direct Connect; VIF (public/private/transit); BGP; LOA-CFA; LAG; MSS clamping; Route 53 Resolver; split-horizon DNS.

Budget and cleanup sworn statement

I verified budgets remain enabled. I deleted lab VPN/CGW resources named ____. I did not order DX ports without Finance. I invented no prices or APIs. Signed ________ date ________.

Interview story to memorize

“TechLearningPro starts hybrid with dual-tunnel VPN into Network Hub TGW, plans DX with transit VIFs when SLA needs it, keeps VPN as backup, never overlaps CIDRs, and treats hybrid DNS as a first-class design—not an afterthought that breaks PrivateLink.”

Self-assessment rubric

Final synthesis before summary

Hybrid success is boring routing, tested failover, and DNS that tells the truth. Everything else is expensive folklore.

Lesson Summary

Site-to-Site VPN provides encrypted hybrid tunnels quickly; Direct Connect adds dedicated connectivity via VIFs with different lead times and cost profiles. Design dual paths, careful BGP/prefix policies, Network Hub termination, and hybrid DNS that respects PrivateLink/PHZ behavior. Tag Project=tlp-lesson51; clean up lab VPNs; verify pricing.

Next: AWS Transit Gateway and Network Architecture.

Further Reading

• AWS Site-to-Site VPN
• AWS Direct Connect
• Direct Connect virtual interfaces
• Route 53 Resolver
• Transit Gateway
• AWS Direct Connect pricing (verify)
• AWS VPN pricing (verify)