Hybrid connectivity and finding unneeded network access

Site-to-Site VPN design

Skill 3.3.2 asks you to design secure connectivity between your own data center (or another cloud) and AWS. The quickest option is AWS Site-to-Site VPN: IPsec tunnels over the internet between your router and AWS. Data Protection Day 4 covered Client VPN for people; this is network to network, and the exam tests the design details: two tunnels, where they end, how fast they go and how to make them faster.

A VPN connection ends on a virtual private gateway (one VPC), a transit gateway (many VPCs and other connections) or AWS Cloud WAN. The newer features (accelerated VPN, Large Bandwidth Tunnels, ECMP, private IP VPN) need a transit gateway or Cloud WAN, so for most multi-VPC exam stories the transit gateway is the right end point.

Accelerated VPN and tunnel logs

An accelerated VPN connection uses AWS Global Accelerator so packets enter the AWS network at the edge location closest to your customer gateway, instead of crossing the whole public internet. Rules: it works only on a transit gateway, NAT-T is required, the customer gateway must start IKE, and it can’t be used over a Direct Connect public VIF. For troubleshooting, turn on Site-to-Site VPN tunnel logs to CloudWatch Logs to see IKE and IPsec negotiation and dead peer detection events.

$ aws ec2 create-vpn-connection --type ipsec.1 \
    --customer-gateway-id cgw-0a1b2c3d --transit-gateway-id tgw-0123abcd \
    --options '{"EnableAcceleration": true, "StaticRoutesOnly": false,
      "TunnelOptions": [
        {"IKEVersions": [{"Value": "ikev2"}],
         "Phase1EncryptionAlgorithms": [{"Value": "AES256"}],
         "Phase2EncryptionAlgorithms": [{"Value": "AES256"}],
         "LogOptions": {"CloudWatchLogOptions": {"LogEnabled": true,
            "LogGroupArn": "arn:aws:logs:eu-west-1:111122223333:log-group:vpn"}}},
        {"IKEVersions": [{"Value": "ikev2"}], "...": "same for tunnel 2"} ]}'

$ aws ec2 describe-vpn-connections --vpn-connection-ids vpn-0f1e2d3c \
    --query "VpnConnections[0].VgwTelemetry[].[OutsideIpAddress,Status]"
[["3.120.10.11","UP"],["18.194.20.22","UP"]]

Direct Connect, VIFs and DX gateway

AWS Direct Connect is a private, dedicated network link from your data center to AWS through a Direct Connect location. It gives steady bandwidth and latency because it doesn’t cross the public internet. The security point the exam loves: a private link is not an encrypted link. Direct Connect traffic is not encrypted by default; you add MACsec or a VPN (next section).

Direct Connect gateway

A Direct Connect gateway is a global resource. Associate it with virtual private gateways, transit gateways or a Cloud WAN core network in any Region except the China Regions, so one VIF can reach VPCs in many Regions. It can belong to a central network account; other accounts send association proposals that the owner accepts, and the owner sets allowed prefixes per association, which limits which VPC CIDRs are advertised to on premises. It doesn’t let two of its associations send traffic to each other (for example VGW to VGW).

$ aws directconnect create-direct-connect-gateway \
    --direct-connect-gateway-name core-dxgw --amazon-side-asn 64512

$ aws directconnect create-direct-connect-gateway-association \
    --direct-connect-gateway-id 5f294f92-bafb-4011-916d-9b0bexample \
    --gateway-id tgw-0123abcd \
    --add-allowed-prefixes-to-direct-connect-gateway cidr=10.10.0.0/16 cidr=10.20.0.0/16

$ aws directconnect describe-virtual-interfaces \
    --query "virtualInterfaces[].[virtualInterfaceType,vlan,virtualInterfaceState]"
[["transit", 101, "available"], ["private", 102, "available"]]

Encrypting Direct Connect: MACsec and private IP VPN

When an exam story says “Direct Connect” and “encryption in transit”, there are two answers. MACsec encrypts the link at Layer 2, at line rate, between your router and the AWS device. Private IP VPN runs IPsec tunnels over Direct Connect, end to end from your device to a transit gateway, using private IP addresses only. Knowing what each one protects, and what each one needs, is the whole skill.

Private IP VPN over Direct Connect

To build it: a transit gateway with a private IP CIDR block for the VPN, a Direct Connect gateway associated with that transit gateway (with the transit gateway CIDR in the allowed prefixes), a transit VIF, and private addresses (RFC 1918 or RFC 6598) on both tunnel ends. Then you create a VPN connection that uses the DX attachment as transport. You can give the VPN attachment a different transit gateway route table from the DX attachment, so some traffic is encrypted and some isn’t. It also raises route scale: AWS lists 5,000 outbound and 1,000 inbound routes, compared with 200 and 100 for Direct Connect alone.

Multi-cloud links

For another cloud, the classic answers are a Site-to-Site VPN to that cloud’s VPN gateway (on a transit gateway) or Direct Connect plus the other provider’s dedicated link at a shared colocation. A newer option is AWS Interconnect (multicloud): a managed private link from a Direct Connect gateway to another cloud, encrypted with MACsec by default. It became generally available on 14 April 2026 with Google Cloud, Oracle Cloud Infrastructure followed in July 2026, and Microsoft Azure is in preview. It attaches to a Direct Connect gateway, so one VPC can use a VGW, many VPCs a transit gateway, and global networks Cloud WAN. Each cloud provider still encrypts its own backbone, so check that the whole path meets your compliance rules. Because it is new, older exam questions will still expect VPN or Direct Connect answers.

$ aws directconnect associate-mac-sec-key --connection-id dxcon-fg31dyv6 \
    --ckn 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \
    --cak fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210

$ aws directconnect update-connection --connection-id dxcon-fg31dyv6 \
    --encryption-mode must_encrypt

$ aws directconnect describe-connections --connection-id dxcon-fg31dyv6 \
    --query "connections[0].[bandwidth,macSecCapable,encryptionMode,portEncryptionStatus]"
["100Gbps", true, "must_encrypt", "Encryption Up"]

Transit Gateway route tables: segmentation and inspection

Once many VPCs and on-premises links meet at one transit gateway, it becomes your most important network control. By default, every attachment can be associated with and propagate to one default route table, which means everything can reach everything. Skill 3.3.2 (and Day 2’s segmentation skill) expects you to split that into separate route tables and to send traffic through an inspection VPC.

$ aws ec2 create-transit-gateway-route-table --transit-gateway-id tgw-0123abcd \
    --tag-specifications 'ResourceType=transit-gateway-route-table,Tags=[{Key=Name,Value=rt-dev}]'

$ aws ec2 associate-transit-gateway-route-table \
    --transit-gateway-route-table-id tgw-rtb-0dev --transit-gateway-attachment-id tgw-attach-0devvpc

$ aws ec2 enable-transit-gateway-route-table-propagation \
    --transit-gateway-route-table-id tgw-rtb-0dev --transit-gateway-attachment-id tgw-attach-0shared

$ aws ec2 create-transit-gateway-route --transit-gateway-route-table-id tgw-rtb-0dev \
    --destination-cidr-block 10.10.0.0/16 --blackhole

$ aws ec2 modify-transit-gateway-vpc-attachment \
    --transit-gateway-attachment-id tgw-attach-0inspect --options ApplianceModeSupport=enable

Verified Access for hybrid workloads

Skill 3.3.3 is about the security requirements of the workloads that cross the hybrid link: who may reach which app, from which device, and how you prove it. A VPN gives a user a route into a whole network. AWS Verified Access gives a user access to one application after checking identity and device on every request, with no VPN. Data Protection Day 4 introduced it for web apps; here we use it for hybrid and non-HTTP workloads.

Designing hybrid workload requirements

Write the requirement first, then pick the control. “Only managed laptops may reach the payroll app” → device trust provider + Cedar policy. “Payroll still runs on premises” → network CIDR endpoint whose traffic travels over Direct Connect or VPN. “Traffic must be encrypted end to end” → TLS to the app, plus MACsec or IPsec on the hybrid link. “Prove who accessed what” → Verified Access logs. For machine-to-machine traffic (servers, not people), Verified Access isn’t the tool: use Site-to-Site VPN or DX with security groups and TGW route tables.

permit(principal, action, resource)
when {
  context.oidc.groups.contains("finance") &&
  context.oidc.email_verified == true &&
  context.jamf.risk == "LOW"
};

Finding unnecessary network access

Skill 3.3.5 asks you to identify unnecessary network access. Rules pile up: an old security group rule, a forgotten internet gateway route, a peering connection nobody uses. Three AWS tools find them, and the exam checks that you pick the right one: Network Access Analyzer (all paths that break a rule), VPC Reachability Analyzer (one path, A to B) and Amazon Inspector network reachability findings (open ports on EC2, automatically).

Inspector network reachability and Reachability Analyzer

Amazon Inspector creates network reachability findings when TCP or UDP ports on an EC2 instance are reachable from VPC edges: an internet gateway (also through an ALB or Classic Load Balancer), a VPC peering connection, or a VPN through a virtual private gateway. It evaluates security groups, NACLs, route tables, gateways and endpoints and runs every 12 hours once Inspector is on, with no extra setup. Findings go to the Inspector console, Security Hub and EventBridge, so you can automate a fix. VPC Reachability Analyzer answers one question: can source A reach destination B on this port? If yes, it shows the hop-by-hop path; if no, it names the blocking component, for example a security group, NACL, route table or load balancer. Combining Inspector package findings with a reachability finding on the same instance tells you which vulnerable hosts are actually exposed.

$ aws ec2 create-network-insights-access-scope --match-paths '[{
    "Source": {"ResourceStatement": {"ResourceTypes": ["AWS::EC2::InternetGateway"]}},
    "Destination": {"ResourceStatement": {"Resources": ["sg-0datatier"]}} }]'
{"NetworkInsightsAccessScope": {"NetworkInsightsAccessScopeId": "nis-0a1b2c3d", ...}}

$ aws ec2 start-network-insights-access-scope-analysis --network-insights-access-scope-id nis-0a1b2c3d
$ aws ec2 get-network-insights-access-scope-analysis-findings \
    --network-insights-access-scope-analysis-id nisa-0f9e8d7c --query "FindingStatus"
"true"

$ aws inspector2 list-findings --filter-criteria \
    '{"findingType":[{"comparison":"EQUALS","value":"NETWORK_REACHABILITY"}]}' \
    --query "findings[].[title,severity]"
[["Port 22 is reachable from an Internet Gateway - TCP", "MEDIUM"]]

Lecture summary map

Day 3 on one screen.

1. Mind map

2. Match the requirement to the control

3. “If the question says… pick…”

Must-remember cheat sheet

Core quiz

Check the basics first. Pick an answer, then press Check.

Hard quiz

Harder than most real exam questions on purpose, with one “choose two” and one matching question. Aim for 9 out of 12 before Day 4.

Practice test questions (from your mock exams)

These 9 questions come from your own SCS-003 mock exams (the last 1 are new questions added in the October 2026 review for features AWS changed in 2025–2026), matched to today’s topics. Each one was checked against current AWS behaviour: where a mock answer used old features (OAI, Classic Load Balancer, Inspector Classic) the wording was updated, and the explanation says so. The source is shown at the end of each explanation, for example “(Mock 5 · Q12)”.

Hands-on lab (30 minutes, low cost)

1. In a test VPC with an internet gateway, launch a small EC2 instance with a security group that allows SSH (22) from 0.0.0.0/0. Tag its security group tier=data.
2. Open VPC → Network Access Analyzer, select the Amazon-created scope All-IGW-Ingress and run an analysis. Open the finding and read each hop: internet gateway, route table, NACL, security group, network interface.
3. Open Reachability Analyzer and create a path from the internet gateway to the instance on TCP 22. Note that it is reachable, then remove the SSH rule and run it again: the result now names the security group as the blocking component.
4. If you have never used Amazon Inspector in this account, activate it (new accounts get a free trial) and, after it has scanned, filter findings by type Network reachability. Compare with the package vulnerability findings for the same instance.
5. Optional, a few cents: create a transit gateway and a Site-to-Site VPN to it using any public IP as a dummy customer gateway. Open the tunnel options and restrict them to IKEv2 and AES-256, look at the two outside IPs, and download a sample configuration. The tunnels will stay DOWN, which is expected.
6. Clean up: delete the VPN connection, the transit gateway attachment and the transit gateway (both charge per hour), terminate the instance, and deactivate Inspector before the trial ends. Network Access Analyzer and Reachability Analyzer charge per run, so don’t schedule them in a personal account. Don’t order a Direct Connect connection for practice: port hours and partner fees are real money.