Direct Connect, and the Fact that It Is Not Encrypted
Gateway, connections, virtual interfaces and associations. A private circuit is a private path, not a private conversation: traffic crosses it in clear text unless MACsec is on, and should_encrypt quietly falls back to clear text.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-12 · how we verify
Use it from the registry
terraform · opentofumodule "direct_connect" {
source = "www.iac-bazaar.com/iac-bazaar/aws-direct-connect/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-direct-connect
A Direct Connect gateway, its connections, the private virtual interfaces on
them, and the associations that reach a VPC or Transit Gateway. Works with
Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.
A Direct Connect link is not encrypted. This is the belief worth correcting first: a private circuit is a private path, not a private conversation. Traffic crosses it in clear text, through a colocation facility and a partner's equipment. Two things change that, and neither is the default:
- MACsec (
request_macsec) encrypts the link. Dedicated 10 or 100 Gbps at supporting locations only.encryption_modethen matters:should_encryptfalls back to clear text when the peer cannot negotiate - the setting that reads as secure and is not - whilemust_encryptdrops the link instead. The module defaults tomust_encrypt - A Site-to-Site VPN over a public virtual interface, at the cost of the tunnel's throughput ceiling
The encrypted_connections output names the connections that asked for MACsec,
which means everything not listed there is in clear text.
One connection is not redundancy. AWS's 99.9% SLA needs two; 99.99% needs
two at different locations. With one, a maintenance window on a single AWS
device is an outage, and the fibre is the last thing anybody suspects. The
distinct_locations output answers that question directly.
Smaller things the module states rather than leaves to be discovered:
skip_destroy, because a DX connection is a physical cross-connect somebody installed. Destroying the resource does not un-install it, and re-creating it means a new order and an engineer visitmtu = 9001needs jumbo frames end to end. On a path that does not carry them, large packets vanish silently and it looks like an application bugbgp_auth_keynull lets AWS generate one, which then lives in the console rather than your configurationsitelink_enabledbills per hour and per GB from the moment it is onallowed_prefixesempty is refused: nothing would be advertised, and the return path would silently not exist
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-client-vpn
Remote-access VPN endpoint with certificate or SAML authentication, split tunnelling, per-group authorization rules and connection logging. There is no allow-all shortcut: an endpoint with no rule reaches nothing.
aws-cloud-map
Private DNS, public DNS or API-only namespaces and the services registered in them. Documents the health-check trap: a private namespace gets a custom check that something else must update, and one nobody updates reports healthy forever.
aws-cloud-wan
A global network whose segments, routing and attachment placement live in one policy document rather than per-region route tables. The policy VERSION is executed as a second step, so a change cannot report success while the network still runs the previous one.
aws-network-acl
Network ACLs are stateless, which is why most of them do not work: the reply to an allowed outbound connection is a new inbound packet nothing lets in. This generates the matching ephemeral-range rule for every TCP and UDP allow.
aws-vpc
Battle-tested multi-AZ VPC with public/private/database subnets, NAT, endpoints, and flow logs.
aws-site-to-site-vpn
Customer gateway, IPsec connection and routes, attached to a VPN gateway or a Transit Gateway. IKEv2 only, DH group 14 and above, AES-256 and SHA-2 - the API still permits DH 2, AES-128 and SHA-1.