The Private Fiber Link
VPNs are cost-effective, but they rely on the public internet — a shared, best-effort network. Internet performance is unpredictable: latency varies, packet loss occurs during congestion, and bandwidth is shared with everyone else. For most workloads, this variability is acceptable. For some, it is not.
Consider these scenarios where internet variability is unacceptable:
- A financial trading platform where milliseconds of latency variance cause real monetary loss.
- A hospital system transferring large medical imaging files (multi-gigabyte MRI scans) that must complete within a predictable time window.
- A company migrating petabytes of data to the cloud — doing this over the internet would take months and cost a fortune in data transfer fees.
For these workloads, you use Direct Connect (AWS's name) or ExpressRoute (Azure's name) or Cloud Interconnect (GCP's name). The concept is the same across all providers: a dedicated, private physical fiber optic connection between your network and the cloud provider's network, completely bypassing the public internet.
How provisioning works:
- The cloud provider has equipment in a small number of colocation facilities (data centers that house equipment from many different companies). Examples include Equinix, CoreSite, and Cyxera facilities.
- You (or a network partner) also place equipment in the same colocation facility, or you work with a Direct Connect Partner who already has equipment there.
- A physical fiber cable — called a Cross-Connect — is run between your rack and the cloud provider's rack within that facility. This is arranged through the colocation facility's management.
- Once the physical link is in place, you configure virtual interfaces on top of it to route traffic to your VPCs.
Performance characteristics:
- Available in speeds from 1 Gbps to 100 Gbps.
- Consistent, low-latency performance because you are not competing with public internet traffic.
- Predictable pricing — you pay a fixed port fee plus data transfer rates, which are typically lower than internet egress rates at high volumes.
Limitations:
- Cost: Significantly more expensive than a VPN, especially at lower bandwidth tiers.
- Provisioning time: Setting up a new Direct Connect link can take weeks to months due to physical infrastructure work.
- Single point of failure: A single Direct Connect link can fail (fiber cut, hardware failure). Production architectures always use redundant links — either two Direct Connect connections to different facilities, or a Direct Connect plus a VPN as a backup path.
Key Point: Direct Connect provides predictable, high-performance connectivity for mission-critical workloads. The trade-off is higher cost and longer provisioning time compared to VPN. Production architectures always include redundancy — either dual Direct Connect links or Direct Connect plus VPN failover.