AWS Certified Solutions Architect - Professional 2020

Sign Up Free or Log In to participate!

Direct Connect and S3 bucket

Here is a scenario –

What do you think? Thanks.
Tom Kringstad

Eric, where are these scenarios coming from that you are posting?

Eric Zhang

An exam dump.

3 Answers

Hi Eric,

As Tom says above, I’m curious where you might have come across this scenario.   If it’s from an exam question dump, it’s kind of a strange question…lots of times the authors of those questions just pile together words.

On the surface, if we are forbidden from having traffic move on the internet, that rules out #2 because a Public Virtual Interface allows Direct Connect users to access the public side of AWS services using the public IPs. 

On the other hand, Option 1 has these EC2 proxies which just does not make sense either.


Eric Zhang

Thanks Scott. Can you point out any AWS documentation that states using public virtual interface means traffic traverse through the internet? I wasn’t able to find any. After all what’s the point of using Direct Connect if your traffic just ends up traversing through the internet.

Eric Zhang

Hi Scott. We’ve been approaching this question in the wrong way. In this case, option 2 (add a public VIF) is correct. Option 1 is not. Because VPN cannot be established over Private VIF as public IP is required for VPN. Also I’m pretty certain no Direct Connect traffic (either public or private VIF) traverses through the internet.

My reason for asking where the scenarios come from is that if it’s from an official exam or even an exam dump then it’s in violation of the AWS terms of agreement for the AWS exams to post the scenario like this. 

As Scott notes, Option 2 can be ruled out based on using the Public Virtual Interface. 

Option 1 is actually the proper way to do this, and requires the use of EC2 proxies. S3 VPC Endpoints are of the Gateway variety, not the Interface variety. Since transitive routing is not supported there needs to be a proxy in the VPC to redirect the Direct Connect traffic to the S3 Gateway. 


Eric Zhang

Thanks Tom. Same as my question to Scott, is there any AWS documentation to say using public VIF means traffic traverses through the internet? If that’s the case, what’s point of getting Direct Connect? Thanks.

Tom Kringstad

Sorry, but using exam dumps violates the AWS terms of agreement. I am modifying the posting accordingly.


Thanks Tom.

Hello Eric,

There is plenty of documentation on Direct connect and VIFs, you just have to look for it  😉 
For instance this was the top of the list when I googled: AWS public VIF

Start by reading the AWS doco or free Kindle Book on Direct Connect, then take a look at some of the implementation scenarios.

Also google: AWS Direct Connect public vif diagram image

Then take some time to draw it out on some paper. so that you have a solid understanding of how the elements fit

Moderator & Coach

Eric Zhang

Thanks Tom and Rusty. I had read through the links you posted as well as the public VIF Digram image prior to posting my question. My original thought was Direct Connect traffic (either private or public VIF) cannot possibly traverse through the internet, oterwise what’s the point of paying for Direct Connect. Then both Tom and Scott have indicated Public VIF traffic traverses the internet and that’s where I became confused. Like I said I wasn’t able to find any AWS documenation that explicitly states Direct Connect via public VIF traverses the internet. The link you posted only answered the question of what public VIF is for.

Eric Zhang

Public Virtual Interface To connect to AWS public endpoints, such as an Amazon Elastic Compute Cloud (Amazon EC2) or Amazon Simple Storage Service (Amazon S3), with dedicated network performance, use a public virtual interface. A public virtual interface allows you to connect to all AWS public IP spaces globally. Direct Connect customers in any Direct Connect location can create public virtual interfaces to receive Amazon’s global IP routes, and they can access publicly routable Amazon services in any AWS Regions (except the AWS China Region).

Eric Zhang

This is how public VIF described in the link. Which part of this statement indicates traffic traverses through the internet? Does mention of "connect to all AWS public IP spaces globally" and " receive Amazon’s global IP routes, and they can access publicly routable Amazon services in any AWS Regions " mean traffic traverse the internet?

Eric Zhang

FYI. I’ve figured it out on my own. A little feedback from me, it’s not nice to be judgemental without knowing the situation. Also posting generic link is a lazy and condescending way of answering questions. I hope you learn some respect, it certainly helps your career.

Sign In
Welcome Back!

Psst…this one if you’ve been moved to ACG!

Get Started
Who’s going to be learning?