Question

A financial services company has a 10 Gbps Direct Connect dedicated connection between their on-premises data center and an AWS Region. A new compliance mandate requires that all data traversing the physical link between their router and the AWS Direct Connect endpoint be encrypted at Layer 2 to protect against physical tapping of the fiber cross-connect. The company wants a solution that operates at line rate with minimal latency overhead and does not require re-architecting their existing IPsec-based application traffic. Which approach meets the requirement?

Accepted Answer

Enable MACsec (IEEE 802.1AE) on the Direct Connect dedicated connection at a supported location, configuring pre-shared CKN/CAK keys on both the customer router and the AWS device.

Answer

Deploy a Site-to-Site VPN over the Direct Connect public VIF so that all traffic is encrypted with IPsec end to end.

Answer

Enable AWS-managed encryption on the Direct Connect virtual interface through the console to encrypt frames on the transit VIF.

Answer

Configure Transit Gateway inter-region peering, which automatically encrypts all traffic crossing the Direct Connect link.