AWS Certified SysOps Administrator – AssociateCost and Performance OptimizationMedium
A financial company is running a highly sensitive application on AWS. They need to ensure that all network traffic between their on-premises data center and their Amazon VPC is encrypted and routed through a dedicated, private connection. They currently use AWS Direct Connect for the private connection but need to add the encryption layer for all traffic. Which solution should a SysOps Administrator implement?
- AConfigure a VPN connection over the public internet to the VPC.
- BEnable AWS VPC Flow Logs for network traffic monitoring.
- CEstablish a Site-to-Site VPN connection over the AWS Direct Connect private connection.
- DUse AWS PrivateLink for secure access to services.
Show answer & explanationAnswer & explanation
Correct answer: C. Establish a Site-to-Site VPN connection over the AWS Direct Connect private connection.
AWS Direct Connect provides a dedicated, private network connection, but it does not encrypt data in transit by default. To add an encryption layer for all traffic while leveraging the private connection, a Site-to-Site VPN connection should be established over the Direct Connect private connection. This creates an encrypted tunnel over the dedicated link.
Why the other options are wrong
- A. A VPN over the public internet would provide encryption but would not use the dedicated Direct Connect private connection, potentially leading to lower performance and higher latency than desired.
- B. AWS VPC Flow Logs are for monitoring network traffic, not for encrypting it.
- D. AWS PrivateLink provides private connectivity to AWS services or services hosted by other AWS accounts, not a general-purpose encryption solution for all traffic between on-premises and VPC over Direct Connect.
VPN over Direct Connect
Combining a Site-to-Site VPN connection with AWS Direct Connect to provide an encrypted private network link between on-premises and AWS.
- Direct Connect provides private, dedicated connectivity.
- VPN adds encryption (IPsec tunnel).
- Ensures secure and private data transfer.
Memory trick: Connect to AWS: private, encrypted, or both.