Skip to content

Primary SAA curriculum

Hybrid Network Connectivity To AWS

Hybrid connectivity progressively by separating the physical path, routing, Transit Gateway segmentation, DNS forwarding, security inspection, and failure recovery.

6 min read

After this, you will understand

This scenario makes hybrid networking easier by splitting one intimidating diagram into five jobs: create a path, advertise routes, segment reachability, resolve names, and survive path failure.

Article guideprerequisites, mental models, and concepts

Article overview

intermediateCloudCertificationNetworking

Three useful mental models

In plain terms

VPN or Direct Connect provides the hybrid path, Transit Gateway connects many networks, route tables decide reachability, and Route 53 Resolver connects the two DNS worlds.

Decision pressure

Teams treat a connection as a complete network, overlook return routes and overlapping CIDRs, or allow every attached network to reach every other network.

Exam-ready model

Plan addresses first, choose the path from the requirement, centralize transit only when scale needs it, make routing and DNS bidirectional, and test redundant paths.

Think before reading

What is the simplest Transit Gateway mental model?

It is a Regional routing hub: networks attach to it, and its route tables decide which attachment receives each destination.

Connected learning

These lessons add useful context to the current core lesson.
  1. 1Multi-Account Cost GovernanceAWS Scenario

A Hybrid Network Is More Than A Connection

A company needs production, development, and shared-services VPCs to communicate with selected systems in its data center. Production must stay isolated from development, private names must resolve in both directions, and one failed path must not disconnect the business.

That creates five separate jobs:

  • Transport provides a physical or encrypted path between locations.
  • Routing tells packets which next hop reaches a destination and how replies return.
  • Segmentation decides which networks should learn routes to one another.
  • DNS translates names into addresses across the two DNS environments.
  • Authorization and resilience decide which traffic is allowed and whether another usable path survives failure.

Before any of them, assign non-overlapping CIDR ranges. If two connected networks claim the same address range, routing cannot reliably infer which one was intended.

The Smallest Useful Architecture

Use AWS Transit Gateway as a Regional hub when many VPCs and hybrid attachments need transitive routing and centralized segmentation. Production, development, shared services, Site-to-Site VPN, and Direct Connect attach to the hub. Different Transit Gateway route tables expose only the intended destinations.

The complete design separates connection, routing, DNS, inspection, authorization, and backup capacity instead of treating them as one networking control.

The components have distinct jobs:

  • The public internet can reach public endpoints, but it does not by itself extend private on-premises routes into a VPC. Site-to-Site VPN adds an encrypted network tunnel while still using the internet as its underlay.
  • Site-to-Site VPN creates IPsec tunnels over internet connectivity. It is relatively quick to establish, encrypted in transit, and useful as a first path or backup. Configure both AWS-provided tunnels, but remember that two tunnels to one customer gateway are not two independent customer devices or sites.
  • Direct Connect supplies dedicated private connectivity with more predictable sustained network behavior and provider lead time. Private does not mean encrypted: add an appropriate encryption layer when required. Reaching Transit Gateway uses a transit virtual interface through a Direct Connect gateway associated with the hub; the physical connection is only the first layer.
  • Transit Gateway replaces a growing peering mesh with a transitive hub. It does not automatically authorize every attachment, and it does not remove VPC route tables.
  • Route 53 Resolver endpoints connect DNS worlds. An inbound endpoint receives queries entering AWS, such as on-premises clients resolving a private hosted zone. An outbound endpoint and forwarding rule send selected AWS queries toward corporate DNS.
  • Security groups and optional network inspection authorize traffic that routing makes reachable. Connectivity itself grants no application permission.

For a small requirement involving only two VPCs, VPC peering may be simpler. Transit Gateway earns its place when centralized transitive routing, hybrid attachments, or segmentation justify the hub.

Follow One Conversation There And Back

Suppose a production EC2 instance calls an on-premises database:

  1. DNS returns the database's on-premises address. Name resolution identifies a destination; it does not create reachability.
  2. The VPC subnet route table matches the on-premises CIDR and selects the Transit Gateway attachment.
  3. The Transit Gateway route table associated with the production attachment selects the Direct Connect or VPN attachment.
  4. The on-premises router receives the packet and local controls allow it to reach the database.
  5. The reply needs corresponding on-premises, Transit Gateway, and VPC routes back to the instance. Security groups, firewalls, and network ACLs must also permit the conversation.
The forward path has two AWS routing decisions, and the conversation succeeds only when the return path is valid too.

BGP can advertise and withdraw reachable prefixes as paths change. It helps routers converge on another route, but it does not carry packets, authorize traffic, or prove that the application at the destination is healthy.

Transit Gateway segmentation depends on two ideas that are easy to blur. Association chooses the route table used to evaluate traffic arriving from an attachment. Propagation determines which route tables learn routes to an attachment's destinations. For example, production can learn on-premises routes while development learns only shared-services routes. Missing routes form the first isolation boundary; security controls then filter traffic that remains routable.

Read deeper into Transit Gateway association and propagation Read deeper into hybrid DNS direction and forwarding

Design Failure As A State Transition

A common design uses Direct Connect as the steady primary path and Site-to-Site VPN as backup. When Direct Connect fails, BGP should withdraw its routes, the VPN path should become preferred, and both directions must converge without creating an asymmetric path through a stateful firewall.

The backup is real only if it has independent customer-side components where required, enough capacity for critical traffic, working DNS, correct return routes, and tested failover and recovery. A green tunnel status alone does not prove that the application can communicate.

SAA Recognition Signals

  • “Encrypted hybrid connectivity needed quickly” points to Site-to-Site VPN because it establishes IPsec tunnels over existing internet connectivity.
  • “Dedicated private connection with predictable sustained behavior” points to Direct Connect because the path is provisioned outside the public internet; add encryption separately when required.
  • “Connect many VPCs and on-premises networks transitively” points to Transit Gateway because it is a managed hub rather than a pairwise peering mesh.
  • “On premises must resolve an AWS private hosted zone” points to a Resolver inbound endpoint because the DNS query enters AWS.
  • “AWS workloads must resolve corporate private names” points to a Resolver outbound endpoint plus forwarding rule because selected queries leave AWS.
  • “Automatically exchange and withdraw network prefixes” points to BGP, while the actual packet path still uses route tables and attachments.

High-Value Traps

  • Do not treat a working connection as proof that routes, DNS, return traffic, or authorization are correct.
  • Do not say Direct Connect encrypts traffic by default.
  • Do not expect VPC peering to provide transitive enterprise routing.
  • Do not place every Transit Gateway attachment in one shared routing domain when environments need isolation.
  • Do not reverse Resolver direction: inbound means queries enter AWS; outbound means queries leave AWS.
  • Do not count two VPN tunnels as full customer-side redundancy or assume an untested backup has enough capacity.

One-Minute Review

A hybrid conversation works only when the path, routing decisions, name resolution, authorization, and return path all agree.
non-overlapping addresses
-> VPN for quick encrypted transport and/or Direct Connect for a dedicated private path
-> Transit Gateway for transitive routing and segmented route visibility
-> VPC route decision, then Transit Gateway route decision
-> Resolver inbound/outbound for the required DNS direction
-> security controls authorize the routable flow
-> return routes and a tested, capable backup complete the conversation

If you remember only one thing: hybrid connectivity works only when transport, forward and return routing, DNS, authorization, and failure behavior agree; no single service supplies all five.

Finished reading?

Your reading history is saved in this browser so you can continue later.

Recommended Next

Multi-Account Cost GovernanceAWS Architecture Scenarios16 min read

This applies the foundation mental models to a real architecture decision instead of a service inventory.

Optional exploration

These links add context, but they do not replace the recommended next lesson.

Arcflow Plus is coming — review drills, research breakdowns, more AI. Get one email at launch.

One email at launch. That's it.