Direct Connect spans two or more locations per region

Check ID: directconnect_connection_redundancy
Provider: AWS
Service: directconnect
Severity: MEDIUM
Categories: resilience
Resource type: Other

What this check verifies

AWS Direct Connect connectivity is provisioned with connection and location redundancy-multiple connections spread across at least two distinct Direct Connect locations in each Region.

Risk

Missing connection/location redundancy creates a single point of failure, degrading availability. A router, fiber, or site outage can sever private paths to AWS, stalling app traffic, data replication, and admin access, leading to timeouts or extended downtime until alternate paths are restored.

Recommendation

Apply redundancy and defense in depth:

Deploy 2 Direct Connect connections across two distinct locations
Use dynamic, active/active routing for automatic failover
Ensure provider/device diversity
Size capacity so one link loss doesn’t overload remaining paths
Consider a VPN as tertiary backup

Remediation

CLI
Terraform
Dashboard steps

aws directconnect create-connection —region <REGION> —location <NEW_DX_LOCATION_CODE> —bandwidth 1Gbps —connection-name <example_resource_name>

# Create an additional Direct Connect connection in a different location
resource "aws_dx_connection" "example" {
  name      = "<example_resource_name>"
  bandwidth = "1Gbps"
  location  = "<NEW_DX_LOCATION_CODE>" # Critical: choose a different DX location in the same Region to achieve location redundancy
}

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = directconnect_connection_redundancy. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DataSync task logs to a CloudWatch Logs log group Direct Connect gateway has redundant virtual interfaces

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires