A company is planning a migration of its critical workloads from an on-premises data center to Amazon EC2 instances. The plan includes a new 10 Gbps…

The key requirements are end-to-end encryption and achieving the highest possible throughput on a 10 Gbps AWS Direct Connect dedicated connection.

MACsec (Media Access Control Security, IEEE 802.1AE) provides Layer 2, line-rate encryption for 10 Gbps and 100 Gbps dedicated Direct Connect connections. This means it can encrypt traffic at the full 10 Gbps speed of the physical link without the performance overhead associated with Layer 3 IPsec VPNs. A transit VIF is the correct interface type to connect a Direct Connect connection to a Transit Gateway via a Direct Connect Gateway. This solution meets both the encryption and maximum throughput requirements.

A. An AWS Site-to-Site VPN tunnel over a public VIF is limited to a maximum throughput of 1.25 Gbps, which is significantly less than the 10 Gbps capacity of the connection.

B. An IPsec VPN to a third-party software appliance on an EC2 instance introduces a bottleneck. The throughput would be limited by the EC2 instance's network performance and CPU, failing to achieve the full 10 Gbps line rate.

D. Using ECMP with two AWS Site-to-Site VPN connections would aggregate throughput to a maximum of 2.5 Gbps (1.25 Gbps per tunnel). This is still much lower than the 10 Gbps offered by the MACsec solution.

1. AWS Direct Connect User Guide - MACsec: "With MACsec, you can secure your dedicated 10Gbps and 100Gbps connections at Layer 2... MACsec secures your data at line rate without impacting the performance of your connection." This document confirms that MACsec provides line-rate encryption, thus achieving the highest throughput.

Source: AWS Direct Connect User Guide, "MACsec" section.

2. AWS Direct Connect User Guide - Virtual interfaces: "Use a transit virtual interface to connect to a Direct Connect gateway. You can then associate the Direct Connect gateway with a transit gateway." This confirms the correct VIF type for connecting to a Transit Gateway.

Source: AWS Direct Connect User Guide, "Direct Connect virtual interfaces" section.

3. AWS Site-to-Site VPN User Guide - Site-to-Site VPN quotas: "The maximum throughput of a Site-to-Site VPN connection is up to 1.25 Gbps." This document explicitly states the performance limitation of IPsec VPN tunnels, making options A and D suboptimal for the "highest throughput" requirement.

Source: AWS Site-to-Site VPN User Guide, "Quotas for your Site-to-Site VPN" section.

4. AWS Whitepaper - AWS Direct Connect Network Security: "MACsec provides native, near line-rate, point-to-point encryption security for 10 Gbps and 100 Gbps dedicated connections at select locations... In contrast, IPsec VPN tunnels have a maximum throughput of 1.25 Gbps." This whitepaper directly compares the performance of MACsec and IPsec over Direct Connect.

Source: AWS Whitepaper, "Building a Scalable and Secure Network in AWS," section on "AWS Direct Connect Network Security." (Note: Specific whitepaper titles may vary, but the content is consistent in official AWS security and networking documentation).