AWS VPN
AWS VPN is the umbrella name Amazon Web Services uses for two separate managed VPN products that both encrypt traffic over the public internet: AWS Site-to-Site VPN, which joins an entire on-premises network to a Amazon VPC, and AWS Client VPN, which lets individual remote users connect into AWS and on-premises resources. Choosing between them (and choosing VPN over AWS Direct Connect in the first place) is the exam-relevant decision this note focuses on.
Key points
- Two products under one umbrella:
- AWS Site-to-Site VPN — network-to-network: connects an entire on-premises data center or branch office to a VPC over an encrypted IPsec tunnel, terminating at a virtual private gateway on the AWS side and a customer gateway on-premises. Use it when a whole office or data center network needs a permanent path into AWS.
- AWS Client VPN — individual remote access: a fully managed, OpenVPN-based client VPN that lets a single named user connect from anywhere into a VPC or on-premises network, authenticated per user or group. Use it for remote employees or admins who each need their own encrypted connection, not for joining two whole networks together.
- Which one do I pick? If the question describes connecting a site, office, or entire on-premises network to AWS, it’s Site-to-Site VPN. If it describes a single person working remotely who needs secure access to VPC resources, it’s Client VPN. The two are complementary, not competing — a company can run both at once for different purposes.
- AWS VPN vs. Direct Connect: both AWS VPN products run encrypted over the public internet and can typically be stood up in minutes to hours; Direct Connect is a dedicated, private physical network connection that bypasses the public internet entirely, taking weeks to provision through a partner or colocation facility. VPN is the fast, low-commitment option (and a common backup link while Direct Connect is being provisioned); Direct Connect is the higher-bandwidth, more consistent, but slower-to-set-up option. The two can also be combined — a Site-to-Site VPN connection layered over a Direct Connect public or private virtual interface adds encryption to Direct Connect’s otherwise unencrypted-by-default traffic.
- Both AWS VPN products bill separately (per VPN connection/endpoint-hour and per active connection) and are distinct again from AWS PrivateLink, which privately exposes specific services rather than joining networks.