Direct Connect vs VPN cost: dedicated links versus encrypted tunnels

Quick answer

A Site-to-Site VPN is cheap to start (an hourly charge for the VPN connection, roughly a few cents per hour, plus standard internet egress on the data), making it ideal for low-to-moderate traffic. AWS Direct Connect provisions a dedicated private link with a port fee (billed per hour by port speed) plus much lower Direct Connect data-transfer rates than internet egress, so it wins at high, sustained data volumes where the reduced per-GB rate outweighs the fixed port cost. The crossover is about traffic volume: low traffic favors VPN, high sustained traffic favors Direct Connect.

Connecting an on-premise network or another location to AWS has two main options with very different cost shapes. A Site-to-Site VPN runs an encrypted tunnel over the public internet, cheap and quick to set up. AWS Direct Connect provisions a dedicated physical link through a partner, more to set up but with lower, predictable data-transfer rates. Which is cheaper depends almost entirely on how much data you move.

The two cost structures

Cost	Site-to-Site VPN	Direct Connect
Connection fee	Hourly per VPN connection (a few cents/hour)	Port fee, hourly by port speed
Data transfer	Standard internet egress rates	Lower Direct Connect transfer rates
Setup	Fast, software config	Physical provisioning, partner, lead time
Performance	Best-effort over internet	Dedicated, consistent

The VPN's cost is a small hourly connection charge plus standard data transfer out at internet-egress rates. Direct Connect flips that: you pay a fixed hourly port fee (which varies by port speed) but the data-transfer rate over the link is meaningfully lower than internet egress. So Direct Connect trades a higher fixed cost for a lower variable rate.

Where the crossover is

Because Direct Connect has higher fixed cost but lower per-GB cost, the two lines cross at a certain traffic volume. Below it, the VPN's near-zero fixed cost wins even at higher per-GB rates. Above it, Direct Connect's lower per-GB rate more than pays back its port fee. For occasional or modest hybrid traffic, a VPN is almost always cheaper. For high, sustained volumes (large data replication, heavy hybrid workloads), the egress savings on Direct Connect can be substantial, since data transfer is often a major cost.

Beyond raw cost

Cost is not the only factor. Direct Connect provides consistent, dedicated bandwidth and lower latency, which matters for performance-sensitive or compliance-driven workloads, while a VPN's best-effort internet path is fine for many uses. Direct Connect also takes time and a partner to provision, whereas a VPN is up in minutes. Many teams start on a VPN and move to Direct Connect once traffic and performance needs justify it, sometimes running a VPN as backup over the Direct Connect link.

Choosing on cost

Estimate your monthly cross-connection data volume and compare: VPN connection fee plus internet egress versus Direct Connect port fee plus its lower transfer rate. For low volumes, choose the VPN. For high sustained volumes, model the Direct Connect savings against the fixed port cost, and remember to factor in performance and reliability needs, not just dollars. Pricing both options before you build, against the resource catalog, shows the crossover for your actual traffic. For the broader question of whether the network layer itself costs money, see does a VPC cost money.

FAQ

Is Direct Connect or VPN cheaper?

It depends on traffic volume. A Site-to-Site VPN has near-zero fixed cost (a few cents per hour) plus standard internet egress, so it is cheaper for low-to-moderate traffic. Direct Connect has a fixed hourly port fee but much lower per-GB transfer rates, so it wins at high, sustained data volumes where the reduced per-GB rate outweighs the port cost. The two cross at a certain volume.

How much does AWS Direct Connect cost?

Direct Connect has two main charges: a port fee billed per hour that varies by port speed, and a data-transfer rate on data flowing over the link that is meaningfully lower than standard internet egress. There may also be partner or cross-connect charges from the colocation provider. The tradeoff is a higher fixed cost in exchange for a lower per-GB transfer rate than a VPN.

How much does a Site-to-Site VPN cost on AWS?

A Site-to-Site VPN charges a small hourly fee per VPN connection (roughly a few cents per hour) plus standard data-transfer-out (internet egress) rates on the data you send. There is no expensive port to provision, so it is cheap and fast to start, making it the better choice for occasional or moderate hybrid traffic where data volumes stay low.

When should I switch from VPN to Direct Connect?

When your sustained cross-connection data volume grows large enough that Direct Connect's lower per-GB transfer rate pays back its fixed port fee, or when you need consistent, dedicated bandwidth and low latency that best-effort internet VPN cannot guarantee. Many teams start on a VPN and move to Direct Connect once traffic volume or performance and compliance needs justify the fixed cost.

Does Direct Connect eliminate data transfer charges?

No, it reduces them. Data flowing over Direct Connect is billed at a lower per-GB rate than standard internet egress, but it is not free. The savings come from that reduced rate applied to high volumes, which is why Direct Connect pays off for heavy, sustained transfer but not for light traffic where the internet-egress cost is already small relative to the port fee.

How does C3X help compare connectivity costs?

C3X prices networking resources like VPN connections and Direct Connect from your Terraform before deploy, so the fixed and transfer costs of each option are visible in the pull request. Modeling both against your expected traffic at design time shows where the crossover is, helping you pick the cheaper connectivity option before you provision it.

What to do next

Compare connectivity options and their transfer costs before you build. C3X prices your resources against a live catalog. Start with the quickstart.