Hybrid and Private Connectivity

Stitching AWS to everything else without losing the encryption argument: Site-to-Site VPN tunnels, Direct Connect virtual interfaces and MACsec, Client VPN against Verified Access for user access, and Route 53 Resolver DNS Firewall for the attack surface everyone forgets.

Content current as of 2026-10.

Lessons

1. VPN, Direct Connect, and MACsec
2. Client VPN and Verified Access
3. DNS as an attack surface

Sources

• SCS-C03 exam guide — Content Domain 3 (tasks 3.1–3.3)
• MAC Security (MACsec) in AWS Direct Connect
• AWS Site-to-Site VPN — how it works
• AWS Verified Access — trust providers and policies
• Route 53 Resolver DNS Firewall