directconnect

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

AWS Direct Connect

Overview

概述

Domain expertise for configuring AWS Direct Connect, the service that gives a customer a private, consistent network link between their own data center or colocation and AWS instead of routing over the public internet. Covers choosing a connection model and completing the cross connect, creating virtual interfaces and bringing up Border Gateway Protocol (BGP), reaching many VPCs through a Direct Connect gateway, encrypting traffic in transit, making the connection resilient, managing link aggregation groups, SiteLink, and migrating from a virtual private gateway to a transit gateway.

This skill is a router. Each customer task maps to a procedure file under

references/

. Read the matching reference in full before acting, then follow its constraints and steps. The reference files are self-contained: each carries its own decision tables, constraints, procedure, and troubleshooting.

Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging, observability). Fall back to the AWS CLI otherwise. The Direct Connect console is regional, so pass the customer's working

--region

aws directconnect

commands; a Direct Connect gateway is a global resource but is reached through a regional console view.

本技能专注于配置AWS Direct Connect，该服务可为客户提供其自有数据中心或托管机房与AWS之间的私有、稳定网络链路，替代通过公网路由的方式。内容涵盖选择连接模型并完成交叉连接、创建虚拟接口并启动边界网关协议（BGP）、通过Direct Connect网关访问多个VPC、加密传输中的流量、实现连接弹性、管理链路聚合组、SiteLink，以及从虚拟专用网关迁移到中转网关。

本技能是一个任务路由工具。每个客户任务都对应

references/

下的一个流程文件。执行操作前请完整阅读匹配的参考资料，然后遵循其中的约束条件和步骤。参考文件是独立完整的：每个文件都包含自己的决策表、约束条件、流程和故障排查内容。

连接后使用AWS MCP服务器执行命令（沙箱执行、审计日志、可观测性）。否则回退使用AWS CLI。Direct Connect控制台是区域性的，因此在

aws directconnect

命令中需传入客户的工作

--region

参数；Direct Connect网关是全局资源，但可通过区域性控制台视图访问。

Which Direct Connect task do you need?

您需要执行哪项Direct Connect任务？

Goal	Reference
Choose dedicated vs hosted vs a link aggregation group, then complete the cross connect	choosing a Direct Connect connection type
Create a private, public, or transit virtual interface and bring up BGP	creating a virtual interface and configuring BGP
Reach many VPCs over one connection through a Direct Connect gateway	connecting many VPCs through a Direct Connect gateway
Encrypt traffic in transit with MACsec or a private IP Site-to-Site VPN	encrypting traffic over Direct Connect
Make the connection survive a failure and tune failover speed	making a Direct Connect connection resilient
Bundle connections into one logical link and manage members	managing link aggregation groups
Connect on-premises sites to each other over the AWS backbone	setting up SiteLink
Move from a virtual private gateway to a transit gateway without dropping traffic	migrating from a virtual private gateway to a transit gateway

目标	参考资料
选择专用型、托管型或链路聚合组连接模型，然后完成交叉连接	选择Direct Connect连接类型
创建私有、公有或中转虚拟接口并启动BGP	创建虚拟接口并配置BGP
通过Direct Connect网关，通过单一连接访问多个VPC	通过Direct Connect网关连接多个VPC
使用MACsec或私有IP站点到站点VPN加密传输中的流量	在Direct Connect上加密流量
实现连接故障恢复并调优故障转移速度	实现Direct Connect连接弹性
将多个连接捆绑为一个逻辑链路并管理成员连接	管理链路聚合组
通过AWS骨干网连接本地站点	设置SiteLink
在不中断流量的情况下从虚拟专用网关迁移到中转网关	从虚拟专用网关迁移到中转网关

Routing notes

路由说明

Connection model comes first. The choosing-a-connection-type reference is the entry point for a customer with no link yet. It settles dedicated vs hosted vs a link aggregation group, checks location support for the chosen speed, and separates a hosted connection from a hosted virtual interface, a distinction customers confuse constantly. Run it before any cross connect is ordered, since port speed cannot change after the connection is created.
A connection carries no traffic until a virtual interface exists. After the cross connect is live, the creating-a-virtual-interface reference is the required next step. The virtual interface type (private, public, or transit) decides what the connection can reach and is fixed at creation. The jumbo-frame maximum transmission unit (MTU) should be set at creation but, on a private or transit virtual interface, can be changed later with a brief connectivity disruption.
One VPC vs many VPCs. A single VPC in one Region can be reached over a private virtual interface to a virtual private gateway. Reaching many VPCs, crossing accounts, or crossing Regions is the Direct Connect gateway reference, which also owns the cross-account transit gateway proposal-and-acceptance handshake.
Encryption is a separate, deliberate step. Direct Connect is not encrypted in transit by default. The encrypting-traffic reference compares MACsec (Layer 2, over the cross connect) against a private IP Site-to-Site VPN over a transit virtual interface (the recommended IPsec path). Route here whenever the customer mentions regulated data or encryption.
Resiliency model vs failover speed are two different questions. The resiliency reference covers both: the Resiliency Toolkit sets the topology and service level target, while BGP hold-timer tuning and Bidirectional Forwarding Detection (BFD) set how fast failover actually converges.
Link aggregation group as a model vs as ongoing management. The connection-type reference introduces the link aggregation group as a model choice at order time. The managing-link-aggregation-groups reference owns ongoing member add/remove and minimum-links behavior, where removing a member can take the whole group down.
Migration is order-dependent. The virtual-private-gateway-to-transit-gateway migration reference exists because doing the cutover steps out of order drops production traffic. Route any "we outgrew the single-VPC model" request here rather than to the plain Direct Connect gateway reference.

连接模型优先：对于尚未建立链路的客户，选择连接类型的参考资料是入口点。它会确定选择专用型、托管型还是链路聚合组，检查所选速率的位置支持情况，并区分托管连接和托管虚拟接口——这是客户经常混淆的区别。在订购交叉连接前需执行此步骤，因为连接创建后端口速率无法更改。
连接在创建虚拟接口前不会传输流量：交叉连接生效后，创建虚拟接口的参考资料是必需的下一步。虚拟接口类型（私有、公有或中转）决定了连接可访问的资源，且在创建时即固定。 jumbo帧最大传输单元（MTU）应在创建时设置，但在私有或中转虚拟接口上，可通过短暂中断连接进行后续修改。
单个VPC vs 多个VPC：单个区域内的单个VPC可通过连接到虚拟专用网关的私有虚拟接口访问。访问多个VPC、跨账户或跨区域则需使用Direct Connect网关参考资料，该资料还涵盖跨账户中转网关的提议与接受流程。
加密是单独的、需主动执行的步骤：Direct Connect默认不加密传输中的流量。在受监管或敏感数据通过链路传输前，您必须将加密作为单独的主动步骤（MACsec或通过中转虚拟接口的私有IP站点到站点VPN）处理。只要客户提及受监管数据或加密需求，就引导至此处。
弹性模型与故障转移速度是两个不同的问题：弹性参考资料涵盖这两方面内容：弹性工具包设置拓扑和服务级别目标，而BGP保持计时器调优和双向转发检测（BFD）设置故障转移实际收敛的速度。
链路聚合组作为模型选择 vs 作为持续管理项：连接类型参考资料在订购阶段将链路聚合组作为模型选择引入。管理链路聚合组参考资料负责成员连接的添加/移除和最小连接数行为，其中移除成员连接可能导致整个组失效。
迁移有顺序要求：虚拟专用网关到中转网关的迁移参考资料存在的原因是，若切换步骤顺序错误会中断生产流量。任何“我们已超出单VPC模型的限制”的请求都应引导至此处，而非普通的Direct Connect网关参考资料。

Security Considerations

安全注意事项

Direct Connect provides a private link into VPC resources, so the security posture differs from the public internet path. Carry these into every task:

Not encrypted by default. Direct Connect does not encrypt traffic in transit. You MUST treat encryption as a separate, deliberate step (MACsec or a private IP Site-to-Site VPN) before regulated or sensitive data crosses the link. See the encrypting-traffic reference.
Physical and colocation security. The link terminates on customer equipment at a Direct Connect location or partner colocation. You SHOULD remind the customer that physical access control and partner trust at that facility are part of the connection's security boundary.
Monitoring and alerting. You SHOULD recommend CloudWatch alarms on connection state and virtual interface BGP status so connection-state changes and failures trigger alerts rather than relying on manual detection.
Audit logging. You SHOULD confirm CloudTrail is enabled and logging
```
directconnect
```
API calls (connection, virtual interface, and gateway-association changes) so all configuration changes are captured for audit and compliance.
CloudWatch Logs encryption. You SHOULD encrypt CloudWatch Logs log groups that receive Direct Connect-related logs or alarm state data with a KMS key, so sensitive connection metadata is protected at rest.
Least-privilege IAM. You MUST scope IAM permissions for
```
directconnect
```
API actions to the specific actions and resources each principal needs, and prefer ephemeral IAM credentials over long-lived IAM user access keys. You MUST NOT grant
```
directconnect:*
```
on resource
```
*
```
or attach any
```
*FullAccess
```
managed policy; instead scope actions to specific resource ARNs, e.g.
```
arn:aws:directconnect:*:*:dxcon/{connection_id}
```
for a connection, so a compromised principal cannot touch every Direct Connect resource in the account.
Route leaks between VPCs. You SHOULD warn that advertising a supernet that overlaps VPC CIDRs can cause unintended VPC-to-VPC traffic over a shared Direct Connect gateway; mitigate with specific prefixes, separate gateways, or transit gateway blackhole routes.

Direct Connect提供通往VPC资源的私有链路，因此其安全态势与公网路径不同。在所有任务中都需遵循以下要点：

默认不加密：Direct Connect不加密传输中的流量。在受监管或敏感数据通过链路传输前，您必须将加密作为单独的主动步骤（MACsec或私有IP站点到站点VPN）处理。请参阅加密流量的参考资料。
物理与托管机房安全：链路在Direct Connect位置或合作伙伴托管机房的客户设备上终止。您应提醒客户，该设施的物理访问控制和合作伙伴信任是连接安全边界的一部分。
监控与告警：您应建议针对连接状态和虚拟接口BGP状态设置CloudWatch告警，以便连接状态变化和故障触发告警，而非依赖人工检测。
审计日志：您应确认已启用CloudTrail并记录
```
directconnect
```
API调用（连接、虚拟接口和网关关联的变更），以便捕获所有配置变更用于审计和合规。
CloudWatch日志加密：您应使用KMS密钥加密接收Direct Connect相关日志或告警状态数据的CloudWatch日志组，以便保护静态存储的敏感连接元数据。
最小权限IAM：您必须将
```
directconnect
```
API操作的IAM权限限定为每个主体所需的特定操作和资源，并且优先使用临时IAM凭证而非长期IAM用户访问密钥。您不得授予资源
```
*
```
的
```
directconnect:*
```
权限，也不得附加任何
```
*FullAccess
```
托管策略；相反，应将操作限定为特定资源ARN，例如连接的
```
arn:aws:directconnect:*:*:dxcon/{connection_id}
```
，这样即使主体被攻陷，也无法触及账户中的所有Direct Connect资源。
VPC之间的路由泄漏：您应警告客户，宣告与VPC CIDR重叠的超网可能导致共享Direct Connect网关出现意外的VPC到VPC流量；可通过特定前缀、独立网关或中转网关黑洞路由缓解此问题。

directconnect

Original

Translation

AWS Direct Connect

AWS Direct Connect

Overview

概述

Which Direct Connect task do you need?

您需要执行哪项Direct Connect任务？

Routing notes

路由说明

Security Considerations

安全注意事项

Additional Resources

其他资源