A multi-county records bureau moves steady high-volume traffic between on-premises systems and AWS. Leadership asks whether AWS Direct Connect or Site-to-Site VPN is the cost-aware hybrid link. What should the architect do?

A multi-county records bureau with steady high-volume hybrid traffic must choose connectivity by total cost of ownership, not slogans. AWS Direct Connect has port-hour and related charges but can reduce data-transfer costs versus sending sustained volume over Site-to-Site VPN and internet egress paths. VPN may remain cheaper for lower or bursty volumes. The cost-aware architect models both DX and VPN (plus internet egress) against measured bandwidth—bytes per month, peak Mbps, and growth—then selects DX when steady high volume makes the overall monthly cost lower and performance more predictable for records exchange.

Always picking VPN because internet egress is free at any sustained volume fails by concept: egress and VPN transfer are not free at scale and can exceed DX economics. Buying the largest DX port without measuring traffic wastes recurring port capacity. Using only CloudFront signed cookies as the private hybrid interconnect confuses a CDN authorization feature with a private network path for bureau backends.

Exam caveat: DX is not automatically cheaper—run the numbers. Also plan redundancy (VPN backup or dual DX) according to SLA; the primary selection still starts from measured volume versus modeled cost.

Operational check: pull hybrid traffic baselines from on-premises firewalls and AWS VPN/DX metrics, build a monthly cost model for VPN+egress versus candidate DX port speeds, pilot DX with a representative records feed, and re-check latency, throughput, and Cost Explorer transfer charges before decommissioning the interim VPN primary path.