A company sets up a new AWS Direct Connect dedicated connection between its data center and an AWS Region to get consistent, high-bandwidth connectivity for a workload with strict data-in-transit encryption requirements. Without adding anything else, is the traffic on this Direct Connect connection encrypted?
- Yes, all traffic sent over any Direct Connect connection is automatically encrypted at the physical layer by AWS with no configuration required
- Yes, but only if the connection uses a private virtual interface rather than a public virtual interface
- No, Direct Connect does not encrypt traffic in transit by default; the company needs to add a Site-to-Site VPN over the Direct Connect connection, or use a MACsec-capable connection, to get encryption
- No, and there is no supported way to encrypt traffic that traverses a Direct Connect connection; encryption must happen entirely at the application layer instead
Why C? And why not the others?
Correct answer: C. No, Direct Connect does not encrypt traffic in transit by default; the company needs to add a Site-to-Site VPN over the Direct Connect connection, or use a MACsec-capable connection, to get encryption
AWS documents plainly that Direct Connect does not encrypt traffic in transit by default. To add encryption, a company can combine Direct Connect with an AWS Site-to-Site VPN, layering an IPsec-encrypted VPN connection on top of the private Direct Connect link, or use a Direct Connect connection at a location that supports MACsec, an IEEE standard providing encryption from the customer's router to the Direct Connect location. The 'automatically encrypted at the physical layer' option is wrong because it directly contradicts AWS's documented default behavior. The 'yes, if private virtual interface' option is wrong because the choice between a private and public virtual interface affects what the connection can route to (VPCs versus public AWS service endpoints), not whether the underlying transport is encrypted; neither type is encrypted by default. The 'no supported way to encrypt' option is wrong because it ignores the two AWS-documented options — VPN over Direct Connect and MACsec — that exist specifically to add encryption to a Direct Connect connection.
Source: AWS Direct Connect User Guide: Encryption in AWS Direct Connect — 'AWS Direct Connect does not encrypt your traffic that is in transit by default,' with VPN-over-Direct-Connect and MACsec as the supported encryption options.