Question

A financial services company connects its on-premises data center to AWS using a 10 Gbps AWS Direct Connect dedicated connection over a private VIF. A compliance auditor mandates that all data traversing the Direct Connect link between on-premises and the VPC must be encrypted in transit at the network layer. The solution must maintain use of the existing Direct Connect connection. Which approach meets this requirement with the least operational overhead?

Accepted Answer

Configure an AWS Site-to-Site VPN connection running over the Direct Connect connection using a public VIF, so IPsec encrypts traffic across the link.

Answer

Enable MACsec on the private VIF to provide encryption without changing the network topology.

Answer

Rely on the physical isolation of the Direct Connect connection, since dedicated connections are inherently private and do not require encryption.

Answer

Terminate the Direct Connect connection and replace it entirely with a Site-to-Site VPN over the public internet to guarantee IPsec encryption.