Hybrid Connectivity Operations
Explore how to diagnose and resolve hybrid connectivity issues in AWS environments using Client VPN, Site-to-Site VPN, and Transit Gateway. Understand distinct failure points, interpret evidence from control planes and routing tables, and identify whether connectivity issues stem from routing, security filtering, or DNS resolution. This lesson equips you with a methodical approach for efficient incident response in hybrid AWS network operations.
Three different AWS services can connect something outside a VPC to something inside it, and they solve overlapping problems in ways that make them easy to confuse during an incident. AWS Client VPN, AWS Site-to-Site VPN, and AWS Transit Gateway each terminate connections on a different kind of object, which means each one fails in a different place and leaves different evidence behind. Treating a symptom as "the VPN is broken" without knowing which of the three is actually involved wastes time checking the wrong control plane object entirely.
Here's how that plays out. On-call access from a laptop and from on-prem networks to the same VPC targets sounds like one problem, but the failure that shows up depends entirely on which hybrid surface is carrying the traffic.
AWS Client VPN terminates individual user sessions on a ClientVpnEndpoint, so the first checks are endpoint association and authorization, and failure usually looks like "cannot connect" or "connects, then cannot reach a private CIDR." AWS Site-to-Site VPN terminates tunnels on a VpnConnection, so the first check is tunnel status, and failure looks like "tunnels down" or "tunnels up but no subnets reachable." AWS Transit Gateway provides a hub through TransitGatewayAttachment and route tables, so the first checks are attachment state and route propagation, and failure often looks partial, where one VPC or one CIDR works and ... ...