All cheat sheets
Networkingcheat sheet

AWS Direct Connect

A dedicated line to AWS drops Data Transfer Out from $0.09/GB to ~$0.02/GB — a 66–75% cut that pays for the port fee many times over at 20+ TB/month of hybrid traffic, and loses money below ~5 TB.

Last reviewed: July 11, 2026

Prefer step by step? Take the guided AWS Direct Connect walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: Direct Connect is a private physical line into AWS: Data Transfer Out drops from ~$0.09/GB to $0.02–0.03/GB, plus you get predictable latency and a private path. The trade is a fixed port fee ($216/month at 1 Gbps, ~$1,620 at 10 Gbps) plus a telecom circuit — so it's transformative at 20+ TB/month of sustained hybrid traffic and a money-loser for light egress. The classic post-install failure: routing still sends traffic over the internet while the paid line idles.

The numbers

  • 100 TB/month: internet $9,000 vs DX $2,216 (1 Gbps port) → **$6,800/month saved**
  • Media-rendering example from the source workflow: 150 TB/month, $13,500 → $4,620 (10 Gbps) — $106k/year
  • Counter-example: 5 TB/month = $450 internet vs ~$616 with port + circuit — DX loses; revisit at 20–30 TB/month
  • Port fees are hourly-billed (no long-term lock-in); the telecom circuit has its own notice terms

Do this

  1. Get the real egress number: Cost Explorer → group by usage type → DataTransfer-Out-Bytes, trailing 3 months. Sustained multi-thousand-dollar egress to fixed destinations is the qualifying profile.

  2. Model break-even honestly: (GB × $0.09) vs (GB × $0.02 + port + circuit). Clearing payback within 3–6 months is the usual green light. Get the telecom cross-connect quote before deciding — distance to a DX location drives it.

  3. Start smaller with Hosted Connections (50 Mbps–10 Gbps through APN partners) if a full dedicated port feels like overcommitment.

  4. After cutover, verify the line is actually used: CloudWatch ConnectionBitsPerSecond on your VIFs. Near-zero while internet egress persists = route tables/DNS still prefer the public path, and you're paying for both.

  5. Plan redundancy: a second DX connection for mission-critical paths, or at minimum a site-to-site VPN failover — a single line is a single point of failure.

Gotchas

  • DX is a path, not a policy. BGP and route tables must prefer it; the most common outcome of a rushed install is an idle paid line (the quiz-question failure in the full workflow).
  • Setup is real networking work: colo cross-connect, Virtual Interfaces, BGP peering. Most teams use a network integrator; once up, it's largely hands-off.
  • Location friction is the deal-breaker — far from a DX facility, circuit extension costs can eat the math.
  • Direct Connect Gateway shares one physical connection across many accounts/VPCs — don't buy a port per account.
  • DX solves AWS ↔ your sites; region-to-region traffic inside AWS wants Transit Gateway Peering instead.

Skip this if

  • Egress is modest (< ~10–20 TB/month) — stay on internet rates and revisit as volume grows.
  • Your egress is scattered across global end-users — that's CloudFront's job, not a dedicated line's.
  • The traffic is AWS-internal — VPC Endpoints and TGW peering address that layer.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are evaluating (report-only) whether AWS Direct Connect would pay
off for this account, and auditing any existing DX setup. Use the AWS
CLI with READ-ONLY credentials. Do not create, modify, or delete
anything.

1. Egress baseline: Cost Explorer grouped by usage type for
   DataTransfer-Out-Bytes (all services), trailing 3 months — volume
   and $ trend. Identify whether the traffic is sustained
   to fixed destinations (on-prem sync, analytics export) vs scattered
   internet users (CDN territory instead).
2. Existing DX: aws directconnect describe-connections /
   describe-virtual-interfaces. If present, check UTILIZATION:
   CloudWatch ConnectionBitsPerSecond per VIF — a near-idle DX while
   internet egress stays high means routing/DNS still prefers the
   public path (the classic double-pay trap). Also check redundancy:
   a single connection with no VPN failover is an availability
   finding.
3. Break-even model: internet egress GB × $0.09 vs DX GB × $0.02 +
   port fee ($216/mo for 1 Gbps, ~$1,620/mo for 10 Gbps) + estimated
   cross-connect/circuit cost (note as unknown, needs telecom quote).
   Mention Hosted Connections (50 Mbps–10 Gbps via partners) for
   volumes that don't justify a dedicated port.

Report: egress volume/trend, break-even verdict with the math shown,
any DX under-utilization or redundancy findings, and next steps
(location check, telecom quote). Change nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The AWS Direct Connect walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Networking cheat sheets

AWS PrivateLink

Interface Endpoints route AWS-service traffic through your VPC privately at $0.01/GB — 4.5× cheaper than NAT Gateway data processing. The payoff is biggest on chatty services: ECR, CloudWatch Logs, Secrets Manager.

AWS WAF Rule Optimization

One rule per blocked IP or bot signature is how teams hit WAF's 1,500-WCU ceiling and a $1/rule/month bill. IP Sets, Regex Pattern Sets, and combined conditions collapse 50 rules into 10 — same protection, 60%+ less capacity and cost.

CloudFront Egress Discounts

Counterintuitive but true: putting CloudFront in front of S3, EC2, or an ALB usually makes the egress bill smaller — CDN transfer rates undercut direct Data Transfer Out, and edge caching removes origin traffic entirely. 30–55% cuts are typical at scale.

CloudFront Private Pricing

AWS's worst-kept secret: at 10+ TB/month of CDN egress you can negotiate custom CloudFront rates — typically 20–40% below the public price list — but only if you ask. AWS will never bring it up first.