Visual overview
AWS provides distinct VPN services for whole-network IPsec connectivity and individual remote users.
Technical reference
AWS has distinct VPN products for network-to-network and user-to-network connectivity.
Encrypted network connectivity from a customer gateway device to a VGW or TGW.
AWS provides two Site-to-Site VPN tunnels for redundancy.
Supported Site-to-Site configurations can exchange routes dynamically rather than relying only on static routes.
Remote users connect to an endpoint using the AWS-provided or supported OpenVPN-based client workflows.
Site-to-Site VPN connects networks over encrypted tunnels
AWS Site-to-Site VPN connects an on-premises network to AWS using IPsec tunnels. The customer side is represented by a customer gateway and customer gateway device; the AWS side terminates on a virtual private gateway or Transit Gateway according to the architecture. Each Site-to-Site VPN connection contains two VPN tunnels to provide redundancy across AWS VPN infrastructure.
Routes can be static or learned dynamically using BGP when the gateway configuration supports it. Dynamic routing is especially important when Direct Connect and VPN form primary/backup hybrid paths or many prefixes are exchanged. Security groups and VPC route tables still govern the workload-side network: the encrypted tunnel creates transport, not unconditional permission to every private resource.
Client VPN connects individual users rather than whole sites
AWS Client VPN is a managed client-based VPN service for securely accessing AWS and on-premises resources from user devices. Users connect to a Client VPN endpoint using the AWS-provided client or supported OpenVPN-based client workflows according to the endpoint's authentication configuration. Unlike Site-to-Site VPN, the client relationship starts from individual remote devices rather than a network gateway representing an entire office or data center.
Client VPN configuration includes target-network associations, routes, authorization rules and authentication. Authentication determines whether a client can establish a session; authorization rules determine which networks authenticated clients may access. Split-tunnel versus full-tunnel behavior affects whether only selected network traffic or broader client traffic is routed through the VPN, and should be designed with security and bandwidth requirements in mind.
VPN and Direct Connect can complement each other
Site-to-Site VPN is internet-based encrypted connectivity and can be established relatively quickly without ordering a dedicated private circuit. Direct Connect provides a dedicated private network path and may offer more consistent network characteristics. Organizations sometimes use them together—for example Direct Connect as a primary path and VPN as a resilient backup, or VPN encryption patterns where confidentiality requirements demand it.
The exam decision starts with who or what is connecting. An office/data-center network points toward Site-to-Site VPN or Direct Connect; roaming individual users point toward Client VPN. Then add requirements for encryption, consistent bandwidth, route scale, deployment lead time and redundancy instead of choosing a service from one keyword alone.
Key takeaways
- 01
Site-to-Site VPN connects networks with IPsec and provides two tunnels per VPN connection.
- 02
Customer gateway, virtual private gateway or Transit Gateway, routing and security all participate in the hybrid path.
- 03
Client VPN is managed remote-user access and uses client sessions, authentication and authorization rules.
- 04
Direct Connect and Site-to-Site VPN solve different transport requirements and can be combined for resilience.
Official AWS sources
Use these primary AWS resources for the source material behind this article and for deeper reference.