Securing Low-Latency Connectivity with AWS Direct Connect

AMJ Cloud Technologies collaborated with a multinational financial services company to enhance their hybrid cloud architecture using AWS Direct Connect. This case study showcases how we achieved low-latency connectivity, improved security, and reduced costs for mission-critical workloads.

Situation

The client, a financial services company operating across North America and Europe, relied on a hybrid cloud architecture to support trading systems, compliance data processing, and internal business applications. With on-premises data centers in London and New York and latency-sensitive workloads running in AWS, the client depended on stable connectivity. However, their existing VPN-based connectivity over the public Internet resulted in unpredictable performance, frequent packet loss, and inconsistent throughput, particularly during peak trading hours.

Task

Our team was tasked with designing a solution to meet the following objectives:

• Achieve consistent, low-latency connectivity between on-premises data centers and AWS.
• Eliminate network congestion and ensure timely regulatory data transfers.
• Reduce high egress data transfer costs associated with Internet-based VPNs.
• Enhance security for sensitive financial data to meet compliance requirements.
• Ensure high availability and operational resilience with minimal downtime.

The project was executed by a team of cloud architects and network engineers over a six-week timeline.

Action

To achieve these objectives, we implemented AWS Direct Connect to establish a dedicated, secure network connection between the client’s on-premises infrastructure and AWS, with a focus on performance, security, and resilience:

1. Direct Connect Location Selection:

   • Selected Direct Connect locations in London (Digital Realty) and New York (Equinix) based on proximity and existing vendor agreements.
   • Ensured optimal connectivity to AWS regions hosting the client’s workloads.

2. Redundant Links & Bandwidth Planning:

   • Provisioned dual 10 Gbps Direct Connect links at each location for fault tolerance.
   • Utilized Link Aggregation Control Protocol (LACP) to increase throughput and enable load balancing across links.

3. Router Deployment:

   • Installed redundant routers in both the client’s on-premises data centers and colocation facilities to eliminate single points of failure.
   • Connected routers to AWS Direct Connect routers using 802.1Q VLAN tagging for secure segmentation.

4. Virtual Interfaces (VIFs) Configuration:

   • Created Private VIFs to connect directly to multiple VPCs via AWS Virtual Gateways (VGW) for hosting internal applications.
   • Set up Public VIFs for accessing AWS public services like Amazon S3 and Route 53 across all regions.

5. Data Encryption:

   • Layered an IPsec VPN tunnel over the Direct Connect link to provide secure, encrypted data transmission, satisfying compliance requirements for financial data.

6. Backup Strategy:

   • Configured an IPsec VPN connection over the Internet as a backup for each Direct Connect path.
   • Implemented BGP failover policies to ensure automatic failover and route priority during outages.

7. Testing and Validation:

   • Conducted simulated failure tests to confirm zero downtime and operational resilience.
   • Monitored latency, throughput, and data transfer costs to validate performance improvements.

The team collaborated with the client to monitor metrics during rollout and fine-tuned configurations to optimize performance and security.

Result

The AWS Direct Connect implementation delivered significant outcomes:

• Consistent Sub-10ms Latency for Latency-Sensitive Workloads: Achieved stable, low-latency connectivity, crucial for high-frequency trading and real-time data analytics.
• 60% Reduction in Egress Data Transfer Costs: Shifting data transfer to Direct Connect significantly lowered costs for high-volume workloads.
• Private, Encrypted Data Transmission Over Dedicated Links: Enhanced security posture by avoiding the public Internet and layering IPsec VPN encryption.
• Zero Downtime During Simulated Failure Testing: Redundant circuits, routers, and BGP failover policies ensured operational resilience, meeting RTO/RPO targets.
• Scalable Hybrid Architecture for Multiple Business Units: Multiple VIFs and hosted VIFs enabled secure, scalable connectivity across AWS accounts and business units.
• Operational Simplicity: Quick implementation with minimal disruption.

This solution has become a reference for AMJ Cloud Technologies’ hybrid cloud connectivity projects, showcasing our expertise in AWS networking and security architectures.

Technologies Used

• AWS Direct Connect (London, New York): Provided dedicated network connectivity.
• 10 Gbps DX links with LACP: Ensured high throughput and fault tolerance.
• Private and Public Virtual Interfaces (VIFs): Enabled secure access to VPCs and public AWS services.
• IPsec VPN over Direct Connect: Secured data transmission.
• AWS Virtual Gateway (VGW): Connected VPCs to Direct Connect.
• Border Gateway Protocol (BGP): Managed routing and failover.
• Redundant Routers (On-premises and at Colocation Facilities): Eliminated single points of failure.
• AWS S3, Route 53, and Amazon EC2: Supported key workloads and services.

Key Use Cases

This architecture is suitable for:

• Financial services companies with latency-sensitive trading systems.
• Enterprises requiring secure, high-performance hybrid cloud connectivity.
• Organizations seeking cost-efficient data transfer solutions for large-scale workloads.

Ready to secure your hybrid cloud connectivity? Contact us to explore how AMJ Cloud Technologies can help.

Key Takeaways

This case study highlights the impact of AWS Direct Connect in achieving low-latency, secure, and cost-efficient connectivity for a financial services client. By transitioning from an unreliable Internet-based VPN to a dedicated network solution, we enhanced performance, security, and operational resilience. AMJ Cloud Technologies is dedicated to delivering practical cloud solutions for mission-critical hybrid architectures.

Architectural Diagram