AWS Direct Connect

Partner Guide

Updated July 2024

Version 3.1

AWS Confidential Information

1
Contents
AWS Direct Connect Overview ...........................................................................................3
What Is AWS Direct Connect?.........................................................................................3
What Is an AWS Direct Connect Partner? ......................................................................3
AWS Direct Connect Service Models .................................................................................4
Dedicated Connection ......................................................................................................5
Hosted Connection .........................................................................................................10
Hosted VIF Model...........................................................................................................17
Frequently Asked Questions .............................................................................................18
Appendix A: Core Concepts / Terminology .....................................................................21
Appendix B: Additional Resources...................................................................................24
Document revisions ...........................................................................................................25

2
Amazon Web Services Whitepaper Title

AWS Direct Connect Overview

What Is AWS Direct Connect?
AWS Direct Connect is a networking service that provides an alternative to using the
internet to connect to AWS. Using Direct Connect, data that would have previously been
transported over the internet is delivered through a private network connection between
your facilities and AWS. In many circumstances, private network connections can
reduce costs, increase bandwidth, and provide a more consistent network experience
than internet-based connections. All AWS services, including Amazon Elastic Compute
Cloud (EC2), Amazon Virtual Private Cloud (VPC), Amazon Simple Storage Service
(S3), and Amazon DynamoDB can be used with Direct Connect.

Additional information about Direct Connect can be found on the Direct Connect FAQ
page.

What Is an AWS Direct Connect Partner?

AWS Direct Connect Partners help customers access AWS Direct Connect. AWS Direct
Connect Partners improve customer experience by providing flexibility and choices on
how to connect with AWS. AWS Direct Connect Partners are experts who have
acquired knowledge of AWS Direct Connect through training and demonstrated
experience. AWS Direct Connect Partners use their expertise to guide customers
through initial design, construction and operation of the customer’s integration with AWS
Direct Connect based on the AWS Direct Connect Partner’s own network services.

The AWS Direct Connect Partner Program recognizes those experts who help AWS
customers establish network connectivity between AWS Direct Connect locations and a
customer’s data center, office, or colocation environment. A network service provider
may enable a customer to access the customer’s AWS Direct Connect Dedicated
Connection – a 1G, 10G, 100G, or 400G physical Ethernet port dedicated to the
customer – by providing services to bridge the gap between the customer and the
customer’s AWS Direct Connect Dedicated Connection. In addition to enabling
customers to access the customer’s AWS Direct Connect Dedicated Connection, AWS
Direct Connect Partners have the exclusive option to integrate the AWS Direct Connect
Partner’s own services with AWS Direct Connect via Hosted Connections. Hosted
Connections are a logical construct that enable AWS Direct Connect Partners to
provision AWS Direct Connect services on behalf of customers in minutes.

3
The AWS Direct Connect Partner Program – as an AWS Service Delivery Program – is
designed for AWS Partner Network (APN) partners (AWS Partners) who specialize in
networking services and wish to differentiate the AWS Partner’s expertise in providing
network connectivity to customers to access customer’s AWS Direct Connect Dedicated
Connections, and optionally, Hosted Connections. AWS Direct Connect Partners are
AWS Partners who achieve the AWS Direct Connect Partner designation via an
application process under the AWS Service Delivery Program. For more information
about the AWS Service Delivery Program, see AWS Specialization Programs Guide,
AWS Service Delivery Validation Checklist: AWS Direct Connect, and AWS Direct
Connect Delivery Technical Calibration Guide. Among other requirements as described
in the AWS Direct Connect Partner Guide (this document) and AWS Direct Connect
Validation Checklist, AWS Direct Connect Partners have demonstrated their expertise
by enabling at least two customers to access AWS services via the customer’s AWS
Direct Connect Dedicated Connections.

AWS Direct Connect Service Models

The following table summarizes the details of the Dedicated Connection and Hosted
Connection models. For more information about terminology, such as virtual interfaces
(VIFs), cross connects, etc., see Appendix A.

Direct Connection Hosted Connection

Connection Physical connection Logical connection provisioned by

dedicated to a single an AWS Direct Connect Partner on
customer behalf of a customer
Speed 1, 10, 100, 400 Gbps 50, 100, 200, 300, 400, 500 Mbps,
1, 2, 5, 10, 25 Gbps1

Cross Connect Owned by Customer, Owned by the Partner or Reseller, is

Partner, or Reseller partitioned logically, and apportioned
account across multiple customers
Last-mile Owned and managed by Service Provider, Partner, or Reseller

1
AWS Direct Connect Partners who on-boarded under the Requirements prior to those
contained in the AWS Direct Connect Partner Guide 2.0 document will not have access to
provision the 1, 2, 5 10, or 25 Gbps Hosted Connection capacities.

4
 Direct Connection Hosted Connection

AWS port-hour charge Billed to AWS account that owns Dedicated Connection or
Hosted Connection

AWS data egress Billed to AWS account that owns associated Virtual Interface(s)
charge

Virtual Interfaces (VIFs) 50 per Dedicated 1 per Hosted Connection2;

Connection customers may obtain multiple
Hosted Connections

Dedicated Connection
An organization does not need to be an AWS Direct Connect Partner to enable a
customer to access the customer’s AWS Direct Connect Dedicated Connections. Any
network service provider (Provider) may enable the customer to access the customer’s
AWS Direct Connect Dedicated Connections.

The typical process for completing a customer’s request for AWS Direct Connect
Dedicated Connections is as follows. A later section covers the differences that
apply to an AWS Partner who is also a member of the Solution Provider
Program:
1. The customer confirms with the AWS Direct Connect Partner, or the
customer’s preferred network service provider, that the AWS Direct
Connect Partner or Provider can provide service at the customer’s desired
AWS Direct Connect locations, and at the customer premises where the
customer wants the AWS Direct Connect Partner or Provider to extend the
customer’s AWS Direct Connect Dedicated Connections. This is an
opportunity to ask the customer if they have thought about resiliency.
2. The customer orders a 1 Gbps, 10 Gbps, 100 Gbps, or 400 Gbps AWS
Direct Connect Dedicated Connections using the AWS Management
Console under the customer’s own AWS account. If this is the customer’s
first AWS Direct Connect Dedicated Connection, the customer might be
asked by AWS for more information in an email message. If there’s no
response from the customer to this message, the connection won’t be
approved until AWS receives a response.

2
For each Interconnect, an AWS partner can provision up to 50 Hosted Connections.

5
3. After the order is processed by AWS, the customer downloads the Letter
of Authorization and Connecting Facility Assignment (LOA-CFA)
document from the AWS Management Console under the Direct Connect
section for each of the customer’s AWS Direct Connect Dedicated
Connections. If the customer doesn’t receive an LOA-CFA document for a
Dedicated Connection, the customer should open a support case to
inquire why the LOA-CFA for that Dedicated Connection has not been
issued.
4. If the customer will use more than one Dedicated Connection at a specific
AWS Direct Connect location to achieve high resiliency at that AWS Direct
Connect location, the customer should use the AWS Management
Console, CLI, or API to compare the appropriate AWS logical device
identifiers (awsLogicalDeviceID) for each Dedicated Connection. If in
doubt, the customer should consult AWS technical support.
5. The customer provides the LOA-CFA for each Dedicated Connection to
the AWS Direct Connect Partner or Provider.
6. For each Dedicated Connection, the AWS Direct Connect Partner or
Provider provisions the customer’s connection from the AWS Direct
Connect location to the customer’s premises using the AWS Direct
Connect Partner or Provider’s network facilities. Note: this step does not
apply if the AWS Direct Connect Partner or Provider is the operator of the
colocation facility in which both the AWS Direct Connect location and the
customer are collocated. In this case, only a cross connect is required to
establish connectivity between AWS and the customer.
7. The AWS Direct Connect Partner or Provider places orders with the AWS
Direct Connect location facility provider for cross connects from the AWS
Direct Connect Partner’s or Provider’s equipment to the AWS equipment
as detailed in the customer’s LOA-CFA documents. AWS Direct Connect
Partners or Providers must factor cost recovery for the cross connects and
other related infrastructure used to provide the customer access circuit in
the overall service charge to the customer. For high resiliency use cases,
AWS Direct Connect Partner or Provider must ensure there is no single
point of failure in the connectivity and services the customer will use to
access their AWS Direct Connect Dedicated Connections.
8. Once the end to end connections are established, the customer may use
the AWS Management Console to provision VIFs on the customers’
Dedicated Connections. Each VIF maps to an 802.1Q VLAN that is tagged
on the associated Dedicated Connection, which the AWS Direct Connect
Partner or Provider will carry to the customer’s premises.

6
 9. For high resiliency use cases, the customer should confirm they have
resilient paths between their AWS services and their on-premises
infrastructure, and they should test fail-over prior to commencing
production use.

Excluding the Solution Provider Program, there is no financial transaction

between AWS and the AWS Direct Connect Partner or Provider when the
Dedicated Connection model is used by a customer. The AWS account that is
assigned the Dedicated Connection is billed by AWS for port-hours and the AWS
account(s) that are assigned the associated Virtual Interfaces are billed for
egress data transfer. The pricing for port-hours and data transfer are public and
available on the AWS Direct Connect website.

Scenarios
Let’s look at three different scenarios in which AWS Direct Connect Partners enable
customers to access the customer’s AWS Direct Connect Dedicated Connections. AWS
Direct Connect Partners may use these scenarios to establish an AWS Direct Connect
practice. Each scenario uses Dedicated Connections rather than the Hosted Connection
model discussed in AWS Direct Connect Hosted Connections, later in this guide. For
simplicity, these examples cover a single connection. For examples of cases where
multiple connections are required for high resiliency refer to the recommended best
practices.

Scenario 1: Customer Requests Dedicated Connection with AWS Direct Connect

Partner Providing Connectivity
In this first scenario, the customer requests an AWS Direct Connect Dedicated
Connection using the customer’s AWS account. The customer asks the AWS Direct
Connect Partner to provide connectivity between the AWS Direct Connect location and
the customer premises (usually referred to in the industry as last-mile connectivity). This
is the simplest way an AWS Direct Connect Partner – or any network service provider –
can enable a customer to access the customer’s AWS Direct Connect Dedicated
Connections.

The AWS Direct Connect Partner connects the customer side router to the AWS Direct
Connect location. The AWS Direct Connect Partner uses the customer’s LOA-CFA
document to order the cross connect from the AWS Direct Connect colocation facility
provider. Some colocation facility operators require the organization ordering a cross

7
connect be named on the accompanying LOA-CFA document. When requesting the
Dedicated Connection, the customer may request a LOA-CFA document that lists both
the customer and AWS Direct Connect Partner.

In this example, any network service provider can help the customer complete the
customer’s connection; the network service provider need not be an AWS Direct
Connect Partner. All AWS Direct Connect Partners are required to support this
Dedicated Connection scenario, and can choose to support additional Dedicated
Connection scenarios (and the Hosted Connection model).

Scenario 2: Customer Requests Dedicated Connection with AWS Direct Connect

Partner Providing Managed Equipment and Connectivity
In this second scenario, the customer requests an AWS Direct Connect Dedicated
Connection using the customer’s AWS account, and asks the AWS Direct Connect
Partner to provide colocation services for the customer’s router and connectivity
services to the customer site. AWS Direct Connect Partners may offer colocation
services, but AWS Direct Connect Partners must provide alternative options that don’t
require the customer purchase colocation services, such as Scenario 1: Customer
Requests Dedicated Connection with AWS Direct Connect Partner Providing
Connectivity discussed previously.

In this scenario, the customer requests/is assigned the AWS Direct Connect Dedicated
Connection. The AWS Direct Connect Partner or the customer can own the router. The
AWS Direct Connect Partner’s involvement in this scenario can range from providing
just the networking gear in the AWS Direct Connect colocation facility to providing full
managed services for the customer, where the AWS Direct Connect Partner manages
the customer’s router configuration. It’s also possible for the AWS Direct Connect
Partner to provide a one-time setup and as-needed support and configuration. There is
room for flexibility.

Typically, the AWS Direct Connect Partner provides the last mile of connectivity from
the AWS Direct Connect location to the customer’s premises, while all other details are
negotiated between the AWS Direct Connect Partner and the customer.

Scenario 3: AWS Solution Provider Manages AWS Direct Connect Service

In this third scenario, an AWS Direct Connect Partner is also a member of the AWS
Solution Provider Program. This program enables qualified AWS Partners to resell AWS

8
services (Solution Provider), including AWS Direct Connect. The Solution Provider
requests an AWS Direct Connect Dedicated Connection on behalf of the customer,
using an AWS account dedicated to the customer. The Solution Provider also provides
connectivity between the customer’s AWS Direct Connect Dedicated Connections and
the customer site.

This scenario enables the Solution Provider to manage the customer’s AWS Direct
Connect service end-to-end, from initial provisioning of Dedicated Connections and
optionally through billing, while preserving ownership of the underlying resources by an
AWS account dedicated to the customer. The Solution Provider Program can be used to
provide services where the customer would like a managed service provider to handle
all aspects of the customer’s AWS Direct Connect service.

The Solution Provider sits between the customer and the AWS Direct Connect location.
The Solution Provider uses an AWS account dedicated to the customer to request the
customer’s Dedicated Connection. The Solution Provider has networking gear already
in the AWS Direct Connect location and can configure it to establish connectivity
between the customer and AWS.

The benefit of this architecture is that the Solution Provider abstracts all the
management of the customers’ Dedicated Connections. From the customer’s point of
view, this scenario is very easy. This also means that the customer only works with one
third-party: the Solution Provider.

Solution Providers may be billed by AWS for all services consumed by the Solution
Provider’s resale customers, including AWS Direct Connect.

Participants in the Solution Provider Program – or any other AWS Direct Connect
Partner – must request Dedicated Connections from an AWS account dedicated to the
end customer. At all times the AWS account dedicated end customer must retain
assignment of the Dedicated Connections used by the customer to access the
customer’s AWS resources.

AWS Direct Connect Workflow

Regardless of the Dedicated Connection scenario a AWS Direct Connect Partner
chooses to support, the steps to set up connectivity are very similar. The first step is
always considering the need for high resiliency, and choosing from one of the
recommended best practices to achieve the desired level of resiliency. Once the desired

9
level of resiliency is selected, the customer and AWS Direct Connect Partner will work
together to confirm an architecture is selected, built and tested to ensure the desired
level of resiliency is achieved.

AWS provides a Getting Started with AWS Direct Connect guide that describes these
steps in more detail. It also contains screenshots of the AWS Direct Connect
Management Console that describe the configuration.

Depending on how the customer and AWS Direct Connect Partner choose to implement
the Dedicated Connection model, the steps are performed by either the customer, AWS
Direct Connect Partner, or one party will do them all.

We recommend that AWS Direct Connect Partners begin with the first scenario, where
the customer requests the AWS Direct Connect Dedicated Connection, and the AWS
Direct Connect Partner provides connectivity to the customer site.

Hosted Connection
Hosted Connections provide customers with two advantages over Dedicated
Connections. Hosted Connections are available in a greater variety of capacities
than Dedicated Connections. Hosted Connections can be provisioned by AWS
Direct Connect Partners in minutes, while Dedicated Connections can take days
to establish. For AWS Direct Connect Partners, multiple Hosted Connections can
be aggregated onto an AWS Direct Connect Interconnect. Interconnects are 1
Gbps, 10 Gbps, or 100 Gbps ports provided by AWS to AWS Direct Connect
Partners. A customer can, and often will, order more than one Hosted
Connection. AWS doesn’t limit the number of Hosted Connections that a
customer can order. This section describes the typical integration of an AWS
Direct Connect Partner’s services with the Hosted Connection model; excluding
the Service Provider Program. Note: For 100Gbps ports for Interconnects, a
discussion with Product Manager is required and is not approved by default.
AWS Direct Connect Partners can provision Hosted Connections for different
customers on the same Interconnect. Each Hosted Connection maps to an
802.1Q VLAN to provide separation between different Hosted Connections. It is
the responsibility of the AWS Direct Connect Partner to assign VLANs when
allocating Hosted Connections to customers, and to deliver each VLAN to the
proper customer.

10
Each Hosted Connection is assigned a fixed committed information rate (which is
set to the capacity of the Hosted Connection) at provisioning. AWS polices each
Hosted Connection to this capacity, and AWS Direct Connect Partners are
required to police each Hosted Connection to its assigned capacity. For AWS
Direct Connect Partners, the total capacity of an Interconnect limits the number of
Hosted Connections the Interconnect will support. For example, a 1Gbps
Interconnect can support two 500 Mbps Hosted Connections, but can’t support
the addition of a third Hosted Connection of any capacity. The sum of the
capacities of all Hosted Connections associated with an Interconnect must be
less than or equal to the capacity of the Interconnect. Oversubscription of
Interconnects is not permitted (for more information see the AWS Direct Connect
Partner Program Requirements section). Note: Partners cannot create a Hosted
Connection that is the same speed as the Interconnect. For example, if you have
a single 10Gbps port for the Interconnect, you cannot provision a single 10Gbps
Hosted Connection.
AWS Direct Connect Partners may create a link aggregation group (LAG) of
multiple Interconnects. Customers may not create a LAG of multiple Hosted
Connections. Partners can LAG up to four ports in a single Interconnect with
1Gbps or 10Gbps ports. For 10Gbps ports, partners can LAG up to two ports in
a single Interconnect. If more ports in a LAG are required, please reach out to
AWS support.

After on-boarding, an AWS Direct Connect Partner can request AWS Direct
Connect Interconnects in the AWS Management Console using the dedicated
AWS account dedicated to the management of Interconnects and customer
Hosted Connections. AWS will issue a LOA-CFA document to the AWS Direct
Connect Partner for each requested Interconnect. AWS Direct Connect Partners
will download each LOA-CFA document via the AWS Management Console.
When ordering the cross connect to establish the Interconnect supply the LOA-
CFA document, AWS Direct Connect Partners are responsible for any fees
associated with cross connects used to establish Interconnects.
To support high resiliency, AWS Direct Connect Partners must maintain at least
two Interconnects at each AWS Direct Connect location where they provide
Hosted Connections to customers. AWS Direct Connect Partners must add
additional Interconnects as needed to support customer requests for resilient
Hosted Connections. AWS Direct Connect Partners must use the AWS

11
Management Console, API or CLI to compare AWS Logical Device values of
Interconnects when provisioning resilient Hosted Connections at a AWS Direct
Connect location to ensure that diverse AWS devices and AWS Direct Connect
Partner devices are used for each Hosted Connection. AWS Direct Connect
Partners must ensure that no single point of failure exists for a customer’s
resilient Hosted Connection service.
In the Hosted Connection model, the customer orders each AWS Direct Connect
Hosted Connection through an AWS Direct Connect Partner. Many AWS Direct
Connect Partners offer a self-service model to customers. A common self-service
model is one where the customer may request Hosted Connections through the
AWS Management Console, a CLI and/or an API, on demand. The AWS Direct
Connect Partner provisions each Hosted Connection VLAN and the
corresponding policer on the AWS Direct Connect Partner’s equipment. The
AWS Direct Connect Partner also provisions each Hosted Connection via the
AWS Management Console, CLI or API. Many AWS Direct Connect Partners
complete provisioning of Hosted Connections minutes after the customer
requests them by making use of preexisting network links to the customer
premises. While the ability for a customer to request Hosted Connections on
demand and begin using newly requested Hosted Connections in minutes are
considered common best practices, AWS Direct Connect Partners are free to
tailor their own service offerings to the particular needs and expectations of their
customers.
The AWS Direct Connect Hosted Connections section of this guide contains the
steps required to request Interconnects and to provision a customer’s Hosted
Connection.
There is no financial transaction between AWS and the AWS Direct Connect
Partner in the Hosted Connection Model for Interconnects. The AWS account
that is assigned the Hosted Connection is billed by AWS for port-hours and the
AWS account that is assigned the associated Virtual Interface is billed by AWS
for the egress data transfer. The AWS Direct Connect Partner is not billed by
AWS for Interconnects. Supported Hosted Connection capacities and associated
AWS prices are published on the AWS Direct Connect website.

12
AWS Account Structure
As part of on-boarding to the Hosted Connection model, AWS Direct Connect Partners
must create a separate AWS account for managing Interconnects. This dedicated AWS
account must be subscribed to Business-level Support so that the AWS Direct Connect
Partner may receive support from AWS for the Interconnects. Once all AWS Direct
Connect Partner Program Requirements have been met, contact AWS support to
have your dedicated AWS account enabled to manage Interconnects. Use of a
dedicated AWS account for managing Interconnects avoids loss of administrative
control over other service objects an AWS Direct Connect Partner may use. AWS Direct
Connect Partners must ensure that additional email addresses are associated with the
dedicated AWS account used to manage Interconnects via the Alternate Contacts
feature. The additional email addresses associated with the dedicated AWS account
must be multiple individuals as appropriate to ensure appropriate coverage and points
of contact for communication at any time.

From an AWS account structure perspective, AWS recommends the following approach
through AWS Organizations. This approach enables AWS Direct Connect Partners to
consolidate billing and administer limitations and controls across various AWS
accounts.

Note that the AWS account structure required for Hosted Connection provisioning may
differ under the Solution Provider Program from the above description.

13
Request an Interconnect
Once on-boarded, AWS Direct Connect Partners can view the current status of
Interconnects or request an Interconnect through the AWS Management Console or via
the API or CLI. If the AWS Management Console looks like the one in Figure 7, where
the menu on the left doesn’t contain an Interconnect menu item, this indicates the AWS
account used to access the AWS Management Console hasn’t been enabled to request
Interconnects in the target region. Please reach out to the assigned AWS Partner
Development Representative or Partner Development Manager to verify status. It is
critical that AWS Direct Connect Partners do not mistakenly request a Dedicated
Connection via the “Connections” menu item. AWS Direct Connect Partners who
request Dedicated Connections will be billed by AWS for those connections.

Create an Interconnect
1. Open the AWS Management Console to the Direct Connect service page. This
can also be done programmatically through the AWS API or AWS Command
Line Interface (AWS CLI).

2. Select Interconnects in the menu and click “Create Interconnect”.

3. Each Interconnect needs the following information:

a. Interconnect name: A name to help you identify the new interconnect.

b. Location: The location in which your connection is located.

14
 c. Port Speed: Desired bandwidth for the new connection.

d. (optional) Existing LAGs: The existing LAG to associate with the newly
created connection.

e. (optional) Tags: Specified tags to help identify a AWS Direct Connect

resource.

View existing Interconnects

If an AWS Direct Connect Partner already has Interconnects, the AWS Management
Console will display a list of all Interconnects in the Interconnect console page.

Create a Hosted Connection

1. Open the AWS Management Console to the Direct Connect service page. This
can also be done programmatically through the AWS API or AWS Command
Line Interface (AWS CLI).

2. Select Interconnects in the menu and select the Interconnect you want to create
the Hosted Connection on. If the Interconnect is part of a LAG, select LAG in the
menu and select the LAG you want to create the Hosted Connection on.

3. Select Hosted Connections tab and click “Allocate connection”.

4. Each Interconnect needs the following information:

a. Connection name: A name to help you identify the new connection. This
will be visible to you and also to the new connection owner.

b. AWS Account ID: The AWS account ID of the customer who will own the
new hosted connection.

c. VLAN: The VLAN number to allocate for this hosted connection.

d. Bandwidth: The bandwidth to allocate for this hosted connection.

e. (optional) Tags: Specified tags to help identify an AWS Direct Connect

resource.

15
View Customer Hosted Connections
If an AWS Direct Connect Partner already has Hosted Connections, the AWS
Management Console will display a list of all Hosted Connections in the Hosted
Connections console page.

What the Customer Sees

Once the AWS Direct Connect Partner has created the customer’s Hosted Connection,
the customer has to accept the Hosted Connection for the Hosted Connection to
become active. For the customer to accept the Hosted Connection, the customer uses
the AWS Management Console to access the AWS Direct Connect Management
console. The customer will see that a Hosted Connection has been allocated in the
customer’s AWS account.

Once the customer accepts the Hosted Connection, the Hosted Connection will be in
the “pending” state until it transitions fully into the “available” state. The Hosted
Connection will also transition to the “available” state in the AWS Direct Connect
Partner’s Hosted Connection list. After the customer has accepted the Hosted
Connection, billing begins immediately. This happens regardless of whether the AWS
Direct Connect Partner has finished provisioning the connection on the physical
infrastructure, or of any other dependencies required to get the connection up and
running. Once the connection is available, the customer can create a VIF. Only one VIF
can be created per Hosted Connection. (Note that the actions required for the end to
end Hosted Connection provisioning process may differ under the Solution Provider
Program from the above description.)

Modifying Hosted Connection Bandwidth

AWS provides partners the capability to increase and decrease Hosted Connection
bandwidth for their customers. A partner can request a change to the Hosted
Connection bandwidth through a support case with AWS. AWS Support will change the
customer’s Hosted Connection bandwidth without requiring a new Hosted Connection to
be created.

When you open a support case requesting a bandwidth modification for a customer
Hosted Connection, please choose the following options:

Issue Type: Technical

16
Service: Direct Connect

Category: Other

If there is not enough available bandwidth on the Interconnect, AWS Support will notify
the AWS Direct Connect Partner that the request cannot be completed. The AWS
Direct Connect Partner would need to add additional links to the Interconnect unil the
amount of free bandwidth on the Interconnect can support the bandwidth increase.

Scenarios

Scenario 1: Customer Requests Hosted Connection with AWS Direct Connect

Partner Providing Connectivity
In this first scenario, the customer requests an AWS Direct Connect Hosted Connection
directly from the AWS Direct Connect Partner. The customer asks the AWS Direct
Connect Partner to provide connectivity between the AWS Direct Connect location and
the customer premises (usually referred to in the industry as last-mile connectivity).

The AWS Direct Connect Partner connects the customer side router to the AWS Direct
Connect location. The AWS Direct Connect Partner uses the Interconnect provisioned
in their device to connect the customer. The AWS Direct Connect Partner will provision
the Hosted Connection within their AWS account for Hosted Connections and share the
connection with the customer’s account. Once the customer accepts the request, the
customer is able to provision the VIF on the Hosted Connection

In this example, only AWS Direct Connect Partners have access to Hosted
Connections. Compared to Dedicated Connections, only one scenario needed for
Hosted Connections.

Hosted VIF Model

A Hosted Virtual Interface (Hosted VIF) is a VIF that is assigned to a different AWS
account from the AWS account associated with the underlying Dedicated Connection.
The Hosted VIF model enables a customer to make a VIF associated with the
customer’s Dedicated Connection available to a different AWS account within the
customer’s organization.

17
Once a Hosted VIF is created, similar to the Hosted Connection model, the AWS
account the Hosted VIF is assigned to must accept the incoming VIF. The AWS account
a private Hosted VIF is assigned to can associate it to an AWS Direct Connect gateway
or a virtual private gateway.

The AWS account associated with the Dedicated Connection underlying a Hosted VIF
pays all of the associated port-hour charges for that underlying connection. The AWS
account that is assigned the Hosted VIF pays all data egress charges associated with
the Hosted VIF.

A Hosted VIF has access to all the capacity of the underlying connection. A Hosted VIF
on an underlying Dedicated Connection has access to all of the capacity of the
Dedicated Connection. A Hosted VIF, like any VIF on an underlying Dedicated
Connection, can congest the Dedicated Connection. This is true even when the
customer or AWS Direct Connect Partner employs traffic shaping or policing on the
customer side of the Dedicated Connection. As AWS does not police or shape traffic of
Hosted VIFs, a UDP flow from AWS towards the customer premises could congest the
Dedicated Connection before the customer or AWS Direct Connect Partner traffic
management has an opportunity to act. Customers and AWS Direct Connect Partners
should be aware of the possibility of congestion due to environments managed by third
parties inherent in the use of Hosted VIFs to access services the customer does not
control. (Note: this possibility does not exist in the case of VMware Cloud on AWS if the
Hosted VIF is used to provide the customer with access to the customer’s Vmware
Cloud on AWS environment.)

In the past, some AWS Direct Connect Partners have used the Hosted VIF model to
provide customers with access to AWS Direct Connect. In many of these cases, the
congestion described above has occurred, resulting in a poor customer and AWS Direct
Connect Partner experience. As a result, AWS no longer permits AWS Direct Connect
Partners to initiate use of the Hosted VIF model to enable customers to access AWS
Direct Connect.

Frequently Asked Questions

Q. What do AWS Direct Connect Partners pay? What do customers pay?

A. AWS Direct Connect Partners should consider the following, based on the AWS
Direct Connect model used:

18
 • Dedicated Connection – AWS bills the customer for the port-hour and data
transfer costs. The AWS Direct Connect Partner is responsible for any fees
associated with obtaining a cross connect and any other network transport or
service provided by the AWS Direct Connect Partner to the customer.

• Hosted Connection – AWS bills the customer for port-hour and data transfer
costs. The AWS Direct Connect Partner is responsible for any fees associated
with obtaining a cross connect and any other network transport or service
provided by the AWS Direct Connect Partner to the customer. There is no cost
for the Interconnect ordered by the AWS Direct Connect Partner.

Q. How do AWS Direct Connect Partners get access to the Hosted Connection
model?

A. To gain access to the Hosted Connection model, AWS Direct Connect Partners must
follow the steps outlined in the AWS Direct Connect Partner Validation Checklist.

Q. Can a customer use an AWS Direct Connect location associated with an AWS
region to access AWS services in a different AWS region?

A. Yes, AWS Direct Connect Gateway enables customers to access a VPC in any AWS
Region (including GovCloud) from a private VIF or transit VIF in any AWS Direct
Connect location (excluding AWS Regions and AWS Direct Connect locations in China).
AWS Direct Connect public VIFs enable customers to access public endpoints in any
AWS Region from any AWS Direct Connect location (excluding AWS Regions and AWS
Direct Connect locations in China).

Q. Does AWS provide latency data for AWS Direct Connect?

A. No. Customers should measure end to end latency and determine the impact of
latency on their applications.

Q. Does AWS offer an SLA for AWS Direct Connect?

A. Yes. For customer requirements to qualify for an SLA and other information, please
review the SLA page.

Q. Does AWS offer guidance for resiliency?

A. Yes, see AWS Direct Connect Resiliency Recommendations. AWS Direct Connect
Partners must maintain at least two Interconnects at each AWS Direct Connect location

19
where they provide Hosted Connections to customers. This allows support for all
resiliency models AWS recommends.

Q. Does AWS require a certain fill rate before ordering a new Interconnect?

A. Yes. The fill rate is the percentage of bandwidth allocated on a given Interconnect.
For example, a 10G Interconnect with two 500Mbps Hosted Connections would have a
fill rate of 10%. AWS requires partners to achieve a 65% fill rate for 10G Interconnects
and an 80% fill rate for 100G Interconnects prior to requesting a new Interconnect port.
Fill rate is looked at on a per Direct Connect location. The service quota for the number
of Interconnects per account is on a per Region basis. If you require a service quota
increase, please contact your Partner Development Manager (PDM) or Partner
Solutions Architect (PSA).

Q. Do I need to be an AWS Direct Connect Partner to offer Dedicated

Connections?

A. No, an organization does not need to be an AWS Direct Connect Partner to enable a
customer to access the customer’s AWS Direct Connect Dedicated Connections

Q. How do I get Direct Connect partner page updated to reflect the sites I can
provide Direct Connect services?

A. Have your Partner Development Manager (PDM) open a ticket with the Direct
Connect Product Management team (PM) to have it updated. Once the PM team
acknowledges the ticket, the page is usually updated within a week.

Q. I am interested in becoming an AWS Direct Connect Partner, but do not have

Dedicated Connection use case examples. Is this required?

A. Yes, two unique use cases of Dedicated Connections are required to be accepted to
the AWS Direct Connect Service Delivery Program. If you do not have use cases and
want to gain access to Hosted Connections, please reach out to your Partner
Development Manager (PDM) or Partner Development Representative (PDR) to discuss
the exception process. The exception process allows organizations to gain access to
Hosted Connections under 1Gbps until they can provide the use cases for full AWS
Direct Connect Service Delivery Program acceptance.

20
Appendix A: Core Concepts / Terminology
AWS Device
A physical device which provides customer AWS Direct Connect Dedicated
Connections or AWS Direct Connect Interconnects.

Dedicated Connection
A 1G, 10G, 100G, or 400G Ethernet port requested directly from AWS by a
customer and dedicated for use solely by that customer.

Interconnect
A 1G, 10G or 100G Ethernet fiber-optic port that is made available only to AWS
Direct Connect Partners. Interconnects are used by AWS Direct Connect
Partners to provide access to Hosted Connections on behalf of customers.

Hosted Connection
A logical service provisioned on behalf of a customer by an AWS Direct Connect
Partner on an Interconnect.

Cross connect
A fiber-optic path from customer or AWS Direct Connect Partner equipment to
AWS equipment as detailed in the AWS Letter of Authorization and Connecting
Facility Assignment (LOA-CFA) document. There is usually a fee associated with
a cross connect, and AWS Direct Connect Partners are expected to include cost
recovery as part of the AWS Direct Connect Partner’s overall service charge to the
customer.

Letter of Authorization (LOA) and Connecting Facility Assignment (CFA)

AWS provides a Letter of Authorization and Connecting Facility Assignment
(LOA-CFA) document to the customer requesting a Dedicated Connection. The
LOA-CFA is the authorization to connect to AWS, and is required by the
colocation provider to establish the cross connect.

21
AWS Direct Connect location
Residing within shared hosting facilities, each AWS Direct Connect location
enables AWS Direct Connect customers to easily connect physical fiber from
their network equipment colocated within the facility to AWS Direct Connect via a
cross connect. Customers can also use the services of a network service
provider or an AWS Direct Connect Partner to access AWS Direct Connect at the
AWS Direct Connect location of their choice.

All AWS Direct Connect locations are published on the AWS Direct Connect website.

Customer router (CR)

A physical router that the customer uses to connect to AWS Direct Connect. This
router can be located within a cage and rack that the customer procures in the
same facility as the AWS Direct Connect location. Or it can be at the customer
premises and connected to AWS via the services of a network service provider or
AWS Direct Connect Partner. The customer configures and manages this device.
The CR needs to support both Layer 2 VLANs, Layer 3 configuration on those
VLANs, and Border Gateway Protocol (BGP) for advertising and receiving of
routes from/to Amazon.

Hosted Connection
Created by the AWS Direct Connect Partner who provides the Hosted
Connection service to a customer. The customer can only create a single virtual
interface (VIF) on each Hosted Connection.

Virtual interface (VIF)

Terminating on the Amazon side of an AWS Direct Connect connection are
virtual interfaces, a prerequisite for using an AWS Direct Connect connection.
Customers configure virtual interfaces within their AWS account.

Hosted VIF
A Hosted VIF is a VIF associated with an AWS account that is not the same AWS
account associated with the Dedicated Connection.

22
Public virtual interface
To connect to AWS services via their public IPs, such as Amazon Simple Storage
Service (Amazon S3), with dedicated network performance, use a public virtual
interface.

A public virtual interface enables customers to connect to all AWS public IP

spaces globally. AWS Direct Connect customers in any AWS Direct Connect
location can create public virtual interfaces to receive Amazon’s global IP routes,
and customers can access publicly routable Amazon services in any AWS
Regions (except the AWS China Region).
Additional details such as the /30 or /31 public address range for the Layer 2
VLAN between the public virtual interface and the customer router (CR), and the
routes that will be advertised into the AWS Region, are supplied when the public
virtual interface is configured.

Private virtual interface

To connect to private services, such as Amazon Virtual Private Cloud (Amazon
VPC), with dedicated network performance, use a private virtual interface.

A private virtual interface enables customers to connect to customer VPC

resources—for example, EC2 instances, load balancers, Amazon Relational
Database Service (Amazon RDS) DB instances, etc.—on a customer’s private IP
address or endpoint. A private virtual interface can connect to an AWS Direct
Connect gateway, which can be associated with one or more virtual private
gateways in any AWS Region (except the AWS China Region). A virtual private
gateway is associated with a single VPC, so customers can connect to multiple
VPCs in any AWS Region (except the AWS China Region) using a private virtual
interface. For a private virtual interface, AWS only advertises the entire VPC
CIDR over the Border Gateway Protocol (BGP) neighbor.

Transit virtual interface

To connect to one or more Amazon VPC Transit Gateways, use a transit virtual
interface.

A transit virtual interface enables customers to connect to customer Transit

Gateways. With transit virtual interfaces, you must connect to an AWS Direct
Connect gateway, which can be associated with one or more transit gateways in

23
any AWS Region (except with AWS China Region). A transit gateway is
attached to one or more VPCs or transit gateways, so customers can connect to
multiple transit gateways in any Region (except the AWS China Region) using a
transit virtual interface.

Border Gateway Protocol (BGP)

A standardized exterior gateway protocol originally designed to exchange routing and
reachability information between autonomous systems (AS) on the internet. BGP is
used within AWS Direct Connect to exchange routing information between a virtual
interface and the customer router (CR). Over a public virtual interface, all AWS public IP
ranges are advertised to the customer, and the customer can advertise their approved
public IP space to AWS. Over a private virtual interface, the VPC CIDR is advertised to
the customer, and the customer can advertise the customer’s on-premises routes to
AWS.

Appendix B: Additional Resources

AWS Webpages

AWS Direct Connect Resiliency Recommendations

AWS Service Delivery Program

AWS Service Delivery Validation Checklist: AWS Direct Connect

AWS Service Delivery Program Guidelines

AWS Direct Connect Partner Website

AWS Direct Connect Partner Program

AWS Direct Connect Documentation (including API Reference)

AWS Direct Connect FAQs

24
Document revisions
Date Description
August, 2023 First publication of version 3 of the AWS Direct Connect
Partner Guide.

25