Global reach
Direct Connect Gateway
Reach VPCs and transit gateways in multiple Regions over a single connection. No separate circuit per Region.
AWS Direct Connect · Dedicated network connection
Connect to AWS over a dedicated line, not the internet
Connect your on-premises data center or office directly to the AWS network with a physical circuit at an AWS Direct Connect location. Bandwidth is predictable, latency is consistent, and traffic is never exposed to the public internet.
Dedicated ConnectionSingle-mode fiber
1Gbps1000BASE-LX
10Gbps10GBASE-LR
100Gbps100GBASE-LR4
400Gbps400GBASE-LR4
For smaller bandwidth, choose a hosted connection (50 Mbps–25 Gbps) through a partner.
99.99%
SLA with maximum resiliency
3
Virtual interface types (Private · Public · Transit)
9001
Private VIF jumbo frame MTU (bytes)
MACsec
L2 encryption on 10·100·400G dedicated connections
Why Direct Connect
Hybrid workloads need a predictable network
An internet VPN is quick to set up, but its path and latency change from moment to moment. Large data migrations, real-time business systems and regulated traffic belong on a dedicated path with guaranteed quality.
Consistent
Consistent performance
Dedicated bandwidth, unaffected by public internet congestion, keeps latency and throughput predictable.
Private
Private path
Traffic stays on the AWS global network. Add encryption with MACsec and IPsec.
Cost
Lower transfer cost
Data transfer out over Direct Connect is priced lower than data transfer out to the internet.
Connection stack
One circuit, three layers
Direct Connect splits a physical circuit into virtual interfaces with VLANs, and each interface exchanges routes over BGP. The stack builds up from the physical layer at the bottom.
L3Routing
BGP peering
Each VIF runs an eBGP session to exchange routes. Control routing with AS_PATH and Local Preference communities, and detect failures quickly with BFD. View exchanged routes with their AS_PATH and communities in the console or with the ListVirtualInterfaceRoutes API.
eBGPMD5 authBFDBGP communitiesIPv4 / IPv6
L2Data link
Virtual interfaces (VIFs)
802.1Q VLAN tags split one circuit into multiple VIFs: a private VIF for VPCs, a public VIF for public AWS services, and a transit VIF for Transit Gateway.
802.1Q VLANPrivate VIFPublic VIFTransit VIF
L1Physical
Cross-connect
At the Direct Connect location, single-mode fiber links your or your partner's router to AWS equipment. Bundle multiple circuits with LACP to form a LAG.
single-mode fiberLOA-CFALACP / LAGMACsecFeatures
Key features
Hub & spoke
Transit Gateway integration
Connect to Transit Gateway through a transit VIF and a DX gateway to route many VPCs from one point.
Global WAN
Cloud WAN integration
Attach a DX gateway directly to an AWS Cloud WAN core network and manage on-premises routes with segment policies.
Site to site
SiteLink
Connect Direct Connect locations directly over the AWS backbone. Branch-to-branch traffic flows without passing through a Region.
Encryption
MACsec · Private IP VPN
Use IEEE 802.1AE MACsec on dedicated connections at supported locations, or run a private IP Site-to-Site VPN over a transit VIF.
Public services
Public VIF
Reach public AWS endpoints such as Amazon S3 without crossing the internet.
Connection types
Dedicated and hosted connections
Choose based on the bandwidth you need and how you want to operate it.
| Type | Bandwidth | VIFs | Best for |
|---|---|---|---|
| Dedicated connection Dedicated |
1 · 10 · 100 · 400 Gbps | Multiple VIFs on one physical port | You own the port and need port-level features such as LAG and MACsec |
| Hosted connection Hosted |
50 Mbps – 25 Gbps | One VIF per connection | A Direct Connect Partner provides the circuit and you want to start quickly with smaller bandwidth |
Reference architecture
From on-premises to VPC
Your router meets AWS at a Direct Connect location. The DX gateway receives the VIFs and propagates routes to VPCs and transit gateways in multiple Regions, while the public VIF leads to public AWS services.
On narrow screens, swipe the diagram sideways.
Resiliency toolkit
Match resiliency to business criticality
The Resiliency Toolkit in the Direct Connect console guides you through ordering connections that match a recommended model. The SLA applies when you follow the recommended configuration.
99.99%
Maximum Resiliency
Place circuits on separate devices at two or more Direct Connect locations. This model withstands device, circuit and location failures and is recommended for critical workloads.
99.9%
High Resiliency
Place one circuit at each of two Direct Connect locations. Connectivity survives the failure of an entire location.
Getting started
How to set up a dedicated connection
- STEP 1
Request a connection
In the console, choose a location and port speed and request the connection.
- STEP 2
Get the LOA-CFA
Once AWS allocates the port, download the LOA-CFA from the console.
- STEP 3
Cross-connect
Give the LOA-CFA to your colocation provider or circuit partner to complete the physical connection.
- STEP 4
Create a VIF
Choose the VLAN, BGP ASN and peer IPs, then create the VIF.
- STEP 5
Verify BGP
Configure BGP on your router, then check the session state and the VIF's received and advertised routes.
Pricing · Standard model
Pay-as-you-go: pay for what you use
This is the default pricing model for all connections. You pay for port hours and for data transferred out of AWS, with no setup fee or minimum charge. Circuit partner and colocation costs are billed separately. For 10 · 100 Gbps dedicated connections you can choose the flat-rate model on the next page instead.
| Charge | Billed by | Notes |
|---|---|---|
| Port hours (dedicated) | Per hour, by port capacity (1 · 10 · 100 · 400 Gbps) | Billed while the port is provisioned, even with no traffic. Japan has slightly lower 1 · 10 Gbps rates. |
| Port hours (hosted) | Per hour, by capacity (50 Mbps–25 Gbps) | Ordered through a Direct Connect Partner; partner service fees are billed separately. |
| Data transfer out of AWS (DTO) | Per GB. Rate depends on the source Region (or Local Zone) and Direct Connect location pair | Even when a DX gateway connects to another Region, the rate of the Region that sent the traffic applies. |
| Data transfer into AWS (DTI) | Free | Data sent from on-premises to AWS is not charged at any location. |
| SiteLink | Per hour per SiteLink-enabled VIF, plus per GB between DX locations | Off by default. Once enabled, the hourly charge applies even with no traffic; transfer rates vary by source and destination geography. |
| Transit Gateway · Cloud WAN | Per attachment hour, plus per GB of data processed | Billed separately under each service. The DX gateway owner pays the Transit Gateway DX gateway attachment charge. |
Rates vary by Region and location. For current rates, see the Direct Connect pricing page.
Pricing · New model (September 2026)
Flat-rate: a fixed hourly rate that includes DTO
A separate pricing model available only for 10 · 100 Gbps dedicated connections. You pay only an hourly rate set by bandwidth and tier, and data transferred out (DTO) from the Regions your tier covers has no per-GB charge. The monthly charge is the hourly rate for your bandwidth and tier × hours the connection is provisioned, rounded up to the hour. Available at Direct Connect locations in all commercial Regions except the China Regions.
| Tier | Scope | Sending Region vs. location | Example |
|---|---|---|---|
| Tier 1 | Local | Same metro | us-east-1 ↔ Ashburn (Virginia) location |
| Tier 2 | Regional | Within the same geography (e.g. continent) | us-east-1 ↔ San Francisco location |
| Tier 3 | Continental | Farther across a continent or geography | us-east-1 ↔ Cape Town location, eu-central-1 ↔ San Francisco |
| Tier 4 | Long-haul | A wide geography or another continent | — |
| Tier 5 | Global | All AWS Regions worldwide | — |
You choose one tier per connection. Each higher tier includes all Regions of the lower tiers, and Tier 1 is the cheapest. The table above shows AWS's general guidelines; check the exact tier for each path in the tables on the flat-rate pricing page.
Pricing · How flat-rate billing works
What flat-rate includes and what you pay separately
| Item | Included in flat-rate | Billed separately |
|---|---|---|
| Port hours | Included (hourly rate by bandwidth · tier) | — |
| Data out from Regions in your tier | Included, no per-GB charge. Applies to private, public and transit traffic | — |
| Data out from Regions outside your tier | — | Pay-as-you-go DTO rates |
| Data into AWS | Always free | — |
| port-pair redundant port | No extra charge for the second port | — |
| SiteLink data | — | SiteLink rates (not included in any tier) |
| Cross-connects · circuits · other services | — | Colocation providers, partners and carriers, plus other AWS services such as Transit Gateway |
| Consideration | Details |
|---|---|
| port-pair | Pairs two dedicated connections on different devices or locations with the same bandwidth and tier. One side is standby, so a 10 Gbps port-pair gives 10 Gbps of usable bandwidth, not 20. You can add existing connections to a Resiliency Group to form a port-pair, or keep them as individual flat-rate connections. |
| Multi-Region connectivity | Attaching a DX gateway, Transit Gateway or Cloud WAN can bring in traffic from multiple Regions. Before attaching, confirm your tier covers every Region you need; expanding to a new Region may require a higher tier. |
| Switching models | Switch any time with Change Billing Mode in the console or the UpdateConnectionsBillingMode API, without interrupting traffic. Within an account the change applies per location: switching one connection switches every connection at that location. |
Next step
Design a Direct Connect setup for your environment
Bring your bandwidth needs, resiliency level and target Regions, and we'll review connection types and routing design together.