Direct Connect gateway has redundant virtual interfaces

Check ID: directconnect_virtual_interface_redundancy
Provider: AWS
Service: directconnect
Severity: MEDIUM
Categories: resilience
Resource type: Other

What this check verifies

Direct Connect gateways and virtual private gateways are assessed for interface redundancy: multiple virtual interfaces (VIFs) distributed across more than one Direct Connect connection. Gateways with only one VIF or with all VIFs on a single connection are identified.

Risk

Missing connection diversity undermines availability. A single device, fiber, or location failure can cut on-prem to VPC connectivity, causing outages, packet loss, or routing blackholes. Fallback to internet VPN can add latency and throttle throughput, delaying recovery and impacting operations.

Recommendation

Apply connectivity defense in depth:

Attach at least two VIFs per gateway on separate Direct Connect connections in distinct locations
Prefer active/active dynamic routing and size capacity to survive a link loss
Optionally add a VPN/Transit Gateway path to sustain operations during provider outages

Remediation

CLI
Terraform
Dashboard steps

aws directconnect create-private-virtual-interface --connection-id <CONNECTION_ID_DIFFERENT_FROM_EXISTING_VIF> --new-private-virtual-interface '{"virtualInterfaceName":"<NAME>","vlan":<VLAN>,"asn":<BGP_ASN>,"addressFamily":"ipv4","amazonAddress":"<AMAZON_IP/30>","customerAddress":"<CUSTOMER_IP/30>","directConnectGatewayId":"<DIRECT_CONNECT_GATEWAY_ID>"}'

# Create a second Private VIF on a different DX connection and attach to the gateway
resource "aws_dx_private_virtual_interface" "example" {
  connection_id   = "<example_resource_id>"      # CRITICAL: use a DIFFERENT Direct Connect connection than existing VIFs
  dx_gateway_id   = "<example_resource_id>"      # CRITICAL: attaches the VIF to the Direct Connect gateway (use virtual_gateway_id for VGW)
  name            = "<NAME>"
  vlan            = 100
  bgp_asn         = 65000
  address_family  = "ipv4"
  amazon_address  = "169.254.100.1/30"
  customer_address = "169.254.100.2/30"
}

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = directconnect_virtual_interface_redundancy. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Direct Connect spans two or more locations per region Directory Service forwards logs to CloudWatch Logs

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires