[tomw]

There are so many questions where you have to decide between answers based on tiny details of AWS services, this big obvious gap that there is no direct connect question really stands out as clearly incorrect. You can set up a DC Gateway without a DC Connection – it just won’t do anything.

[tomw]

Thanks Kenneth. An application will probably stay available using spot fleets during an AZ outage, but they might not as capacity will be tight. If an application *has* to stay up then reserved capacity is important.

I would probably tweak the question / answers a bit to de-emphasize the AZ outage part, as people who’ve worked in AWS in the real world for some time are probably more likely to get this wrong than someone with less experience.

[tomw]

Thanks for your reply. I work in AWS professionally and have for years, VPN is always the obvious and first choice for a DirectConnect backup unless VPN(s) isn’t suitable for some reason. In the real world I would look at creating a VPN to a Transit Gateway VPN attachment ( https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-transit-gateway-vpn.html ).

I did see “addressed immediately” in the question but I thought the “MOST cost effective” part of the question (with MOST in capitals) was the key to this question. The answer when copied in full says to establish tunnels to each of the ten VPCs. I interpreted that as 10 VPNs. Is that deliberate in that question? Or should it be tweaked?

Full text of answer “Establish VPN tunnels from your on-premises data center to each of the 10 VPCs. Terminate each VPN tunnel connection at the virtual private gateway (VGW) of the respective VPC. Configure BGP for route management.”