Direct Connect connections span at least two locations per region
directconnect_connection_redundancy
AWS Direct Connect connectivity is provisioned with connection and location redundancy-multiple connections spread across at least two distinct Direct Connect locations in each Region.
Risk
Missing connection/location redundancy creates a single point of failure, degrading availability. A router, fiber, or site outage can sever private paths to AWS, stalling app traffic, data replication, and admin access, leading to timeouts or extended downtime until alternate paths are restored.
prowler aws --checks directconnect_connection_redundancy
Recommendation
Apply redundancy and defense in depth:
- Deploy 2 Direct Connect connections across two distinct locations
- Use dynamic, active/active routing for automatic failover
- Ensure provider/device diversity
- Size capacity so one link loss doesn't overload remaining paths
- Consider a VPN as tertiary backup
Remediation
aws directconnect create-connection --region <REGION> --location <NEW_DX_LOCATION_CODE> --bandwidth 1Gbps --connection-name <example_resource_name>
- In the AWS Console, go to Direct Connect > Connections
- Click Create connection
- Region: select the Region where the existing connection resides
- Name: enter <example_resource_name>
- Location: select a different Direct Connect location than your existing connection
- Bandwidth: choose a supported value (e.g., 1 Gbps)
- Click Create connection
Source Code
Resource Type
Other