A company is planning a migration of its critical workloads from an on-premises data center to Amazon EC2 instances. The plan includes a new 10 Gbps…

MACsec (Media Access Control Security) provides Layer 2 encryption for 10 Gbps and 100 Gbps AWS Direct Connect dedicated connections. It encrypts data at line rate between the on-premises network device and the AWS Direct Connect location, ensuring the highest possible throughput (10 Gbps) is maintained while meeting the encryption requirement. A transit VIF is then used to connect the Direct Connect gateway to the transit gateway, providing connectivity to the VPCs. This solution directly addresses both the high throughput and encryption requirements without the performance bottlenecks of IPsec VPNs.

A. An AWS Site-to-Site VPN connection over a public VIF is limited to a maximum throughput of 1.25 Gbps per tunnel, which does not meet the 10 Gbps requirement.
B. An IPsec VPN to a third-party software appliance on an EC2 instance is limited by the instance's network performance and CPU, and it is unlikely to achieve 10 Gbps.
D. Using two VPN connections with ECMP would provide approximately 2.5 Gbps of throughput, which is still significantly less than the required 10 Gbps.

1. AWS Documentation. (2023). MACsec. AWS Direct Connect User Guide. Retrieved from https://docs.aws.amazon.com/directconnect/latest/UserGuide/MACsec.html. (See the introduction: "MAC Security (MACsec) is an IEEE standard that provides data confidentiality... for 10 Gbps and 100 Gbps Dedicated Connections").

2. AWS Documentation. (2023). AWS Site-to-Site VPN Quotas. AWS Site-to-Site VPN User Guide. Retrieved from https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-limits.html. (See table entry for "Site-to-Site VPN connection tunnel bandwidth").