We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Cloud Infrastructure
Free preview: the first 2 parts of this 6-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Cloud Infrastructure
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
Most companies don't go all-in on cloud overnight. They have existing on-premises infrastructure. Active Directory, file servers, legacy databases, internal tools, that still runs in the office or a private data center. But new applications are being built in the cloud.
A site-to-site VPN connects these two worlds. Your office network (10.1.0.0/16) and your AWS VPC (10.0.0.0/16) become one extended network. An application in AWS can query a database in the office. A service in the office can call an API in AWS. Users don't even notice the boundary, it's smooth.
This is the foundation of hybrid cloud architecture. Almost every enterprise that uses AWS, Azure, or GCP has at least one site-to-site VPN running. It's the first step before (and sometimes instead of) dedicated connections like AWS Direct Connect.
Two endpoints, one tunnel:
AWS creates two IPsec tunnels for redundancy (different endpoints on the AWS side). If one tunnel fails, traffic automatically fails over to the other.
Key specs:
| Parameter | Value |
|---|---|
| Encryption | AES-256 |
| Protocol | IPsec (IKEv2 recommended) |
| Tunnels per connection | 2 (active/passive or active/active) |
| Up to 1.25 Gbps per tunnel | |
| Varies, traffic crosses the public internet | |
| Cost | ~$36/month per connection + data transfer |
Limitations:
When to upgrade to Direct Connect: If you need consistent latency, bandwidth above 1.25 Gbps, or you're transferring terabytes of data regularly, Direct Connect ($200+/month) provides a dedicated physical connection that bypasses the internet entirely.