/directconnect

Setting Up Direct Connect SiteLink

Overview

Domain expertise for SiteLink, the Direct Connect feature that connects two or more Direct Connect locations so on-premises sites attached to them can exchange traffic over the AWS backbone without routing through a VPC or a Region. Covers when SiteLink fits, the per-virtual-interface enablement, the single-partition requirement, the private/transit virtual interface requirement, and the per-gigabyte billing the customer is opting into.

Does not cover choosing the connection model, virtual interface and BGP setup (a separate reference), reaching VPCs through a Direct Connect gateway, or encryption. Those are separate references.

Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging, observability). Fall back to the AWS CLI otherwise. The Direct Connect console is regional; pass the customer's working --region on every aws directconnect command.

Table of Contents

• Overview
• When SiteLink fits
• Per-virtual-interface enablement
• Single partition and virtual interface type
• Per-gigabyte billing
• Troubleshooting
• Procedure
• Additional Resources

When SiteLink fits

Constraints:

• You SHOULD reach for SiteLink when two or more on-premises sites, attached to different Direct Connect locations in the same AWS partition, need to communicate and routing through a Region is undesirable.
• You SHOULD remind the customer that traffic over SiteLink is not encrypted in transit by default, and point them to the encrypting-traffic reference if the workload requires encryption.

Per-virtual-interface enablement

Constraints:

• You MUST enable SiteLink on each private or transit virtual interface that should participate. SiteLink is set per virtual interface, not once for the connection, so enabling it on one interface does not bring in the others.

Single partition and virtual interface type

Constraints:

• You MUST confirm all participating sites are in the same AWS partition before proposing SiteLink; it cannot link a commercial Region site to an AWS GovCloud (US) site.
• You MUST confirm the virtual interface type is private or transit; SiteLink does not run on a public virtual interface.

Per-gigabyte billing

Constraints:

• You MUST state the per-gigabyte SiteLink data transfer charge, which is separate from standard Direct Connect data transfer and applies as soon as the feature is on, before enabling SiteLink. The customer should be opting into metered transfer knowingly, not discovering it on the invoice.

Troubleshooting

Some sites still cannot reach each other after enabling SiteLink

SiteLink is per virtual interface. Enable it on every participating private or transit virtual interface.

SiteLink will not link two sites

They are in different AWS partitions (for example commercial and GovCloud). SiteLink works only within one partition.

SiteLink option is not available on a virtual interface

It is a public virtual interface. SiteLink runs only on private and transit virtual interfaces.

Unexpected data transfer charges after turning on SiteLink

SiteLink carries a separate per-gigabyte charge. It applies as soon as the feature is enabled.

Need to disable SiteLink on a virtual interface

Disable with:

aws directconnect update-virtual-interface-attributes \
  --virtual-interface-id {virtual_interface_id} --no-enable-site-link --region {region}

Procedure

Overview

This procedure confirms the partition and virtual interface type, states the billing, enables SiteLink on each participating virtual interface, and surfaces the console link.

Parameters

• virtual_interface_ids (required): The private or transit virtual interfaces to enable SiteLink on, one per participating site.
• partition_confirmed (required): Confirmation that all sites are in the same AWS partition.

Constraints for parameter acquisition:

• You MUST list every virtual interface that should participate, since each one must be enabled.

Steps

1. Verify dependencies and the billing acknowledgement

Constraints:

• You MUST confirm credentials with aws sts get-caller-identity.
• You MUST use ephemeral IAM credentials (e.g., AWS SSO, an instance profile, or aws sts assume-role) rather than long-lived IAM user access keys for Direct Connect management operations.
• You MUST confirm all sites are in the same AWS partition and that each target virtual interface is private or transit.
• You MUST surface the per-gigabyte billing and get the customer's acknowledgement before enabling.

2. Enable SiteLink on each virtual interface

Constraints:

• You MUST confirm each virtual interface is attached to a Direct Connect gateway (DXGW), not a virtual private gateway (VGW). SiteLink requires a DXGW association.

• You MUST enable SiteLink on every participating virtual interface, not just one:

  aws directconnect update-virtual-interface-attributes \
    --virtual-interface-id {virtual_interface_id} --enable-site-link --region {region}

• You MUST verify SiteLink is active:

  aws directconnect describe-virtual-interfaces \
    --virtual-interface-id {virtual_interface_id} \
    --query 'virtualInterfaces[0].{State:virtualInterfaceState,SiteLink:siteLinkEnabled}' \
    --output table --region {region}

  Poll until siteLinkEnabled reports true.

3. Confirm and surface the console link

Constraints:

• You MUST confirm SiteLink is enabled on each virtual interface and present the console link, filling {virtual_interface_id} and {region}:

  https://console.aws.amazon.com/directconnect/v2/home?region={region}#/virtual-interfaces/{virtual_interface_id}

• You SHOULD recommend CloudWatch alarms on the virtual interface state and BGP status, and confirm CloudTrail is capturing directconnect API calls with log file validation enabled and the trail encrypted with a KMS key, and any CloudWatch Logs log groups receiving these events or alarm state data encrypted with a KMS key, so state changes trigger alerts and configuration changes are audited with assured log integrity and confidentiality rather than relying on manual detection.

• You SHOULD ensure any SNS topics receiving Direct Connect alarm notifications are encrypted with a KMS key and that subscriptions are restricted to authorized operations personnel.

Security Considerations

• Not encrypted by default. Direct Connect does not encrypt traffic in transit. You MUST treat encryption as a separate, deliberate step (MACsec or a private IP Site-to-Site VPN) before regulated or sensitive data crosses SiteLink. See the encrypting-traffic reference.
• Ephemeral credentials. You MUST use ephemeral IAM credentials (e.g., AWS SSO, an instance profile, or aws sts assume-role) for Direct Connect management operations rather than long-lived IAM user access keys.
• Least-privilege IAM. You MUST scope IAM permissions for directconnect API actions to the specific actions and resource ARNs each principal needs, and MUST NOT grant directconnect:* on resource * or attach any *FullAccess managed policy.

Additional Resources

• AWS Direct Connect SiteLink (AWS Direct Connect User Guide)
• Direct Connect virtual interfaces and hosted virtual interfaces (AWS Direct Connect User Guide)
• AWS Direct Connect pricing