AWS SAP Direct Connect resiliency locations and LAG
Two ports in one building is not two buildings. A LAG adds bandwidth at one DX location; it does not invent a second site.
<!-- hal:authoritative:yaml -->
Two ports in one building is not two buildings. A LAG adds bandwidth at one DX location; it does not invent a second site.
§I — Frame
Last SAP fire on SoT taught Interface VPC endpoints and PrivateLink (09-07). That leftover stays on its shelf. Route53 failover (08-26) and Transit Gateway RAM (08-14) stay too.
Today the exam grain is hybrid physical path resilience. SAP bootcamp: order two DX ports, prefer two DX locations, put customer routers and on-premises routers in geographically separated buildings. Then contrast LAG: multiple physical connections acting as one, same speed, same DX location, Active/Active, minimumLinks for when the bundle stays up.
§II — Resilience ladder (bootcamp images 1 through 4)
| Pattern | What you buy | Failure it still eats |
|---|---|---|
| Single port, single location | One LOA-CFA cross-connect path | Device, cage, or building loss |
| Dual ports, one location | Two cross-connects, two customer DX routers into two on-prem routers | Whole DX location / metro hit |
| Dual locations | Two DX locations + geographically separated routers | Regional design mistakes on VIF/TGW side remain |
| Extreme | Dual locations plus redundant on-prem buildings and routing | Still needs correct VIF (Private/Public/Transit) and BGP hygiene |
Bootcamp labels the progressive diagrams: none, resilient, improved, extreme. The exam trap is calling a single-location dual-port design "multi-site HA."
Physical facts that feed the design: DX is a port allocation at a DX Location (1/10/100 Gbps dedicated, or partner hosted speeds). Single-mode fibre. BGP + BGP MD5 on the customer router. Provisioning measured in weeks or months. Inbound data transfer free; outbound charged. LOA-CFA authorizes the colo staff to plant the cross-connect.
§III — LAG: bandwidth tool, not site insurance
Link Aggregation Group:
- Bundle 2×100 Gbps, or up to 4 ports under 100 Gbps each, max 200 Gbps aggregate in the bootcamp note.
- All members same speed, terminate at the same DX location.
- Active/Active.
- Attribute
minimumLinks: LAG stays active while working member count ≥ that floor. - Bootcamp: LAG provides some device-level resilience but AWS does not market it as location resilience. Hardware failure of the location still takes the LAG.
Exam contrast pair:
- Need more Gbps at one colo → LAG (or a faster port).
- Need survive colo or metro loss → second DX location (and usually second on-prem path), not a fatter LAG.
MACsec (hop-by-hop L2 encryption on the DX/LAG segment) is adjacent, not the resiliency answer. VPN over Public VIF is end-to-end encryption; MACsec is not a substitute for that story.
§IV — VIF adjacency (do not reteach PrivateLink)
Resiliency of the physical path is useless if the logical overlay is single-homed wrong:
- Private VIF → VGW → one VPC (or DX Gateway patterns for wider reach).
- Public VIF → public zone services; VPN-over-DX uses this path to VGW/TGW endpoints.
- Transit VIF → DX Gateway ↔ Transit Gateway (regional attachment discipline from 08-14 stays referenced, not re-taught).
Dedicated DX: up to 50 public/private VIFs and 1 Transit VIF (bootcamp). Hosted VIFs share into other accounts. Today only names these so the resiliency answer does not accidentally become a VIF type question.
§V — What not to do
Do not answer "add a LAG" when the stem says the DX location failed. Do not treat dual ports in one building as extreme resiliency. Do not confuse DX (private physical path, weeks to provision) with Site-to-Site VPN over the internet (hours, encrypted, variable latency). Do not re-teach Interface VPC endpoints / PrivateLink (09-07) as tonight primary. Do not open Route53 Resolver hybrid DNS as primary (valid future SAP fire; not this bundle).
§VI — Close instruction
Sketch four boxes: none / dual-port / dual-location / extreme. Write one sentence each on what dies. Then write the LAG one-liner: same location, Active/Active, minimumLinks, bandwidth not metro HA. Pair: Ops censuses SQS DLQs; Dev registers singledispatch formatters. Maghrib owns the quiz later.