Site-to-Site VPN across clouds
IPsec tunnels between your network and a cloud VPC - gateway, peer definition and connection, with BGP for routes that do not go stale.
4 verified modules, 1 of them live-tested apply→verify→destroy; the rest are static-validated, live-test pending.
Compare by provider
| Provider | Module | Verification |
|---|---|---|
| AWS | Site-to-Site VPN with Modern Crypto | static-validated |
| Azure | A Site-to-Site VPN with Modern Crypto, BGP, and a Connection | static-validated |
| Google Cloud | HA VPN (Site-to-Site) | ✓ live-tested |
| Oracle Cloud | A Site-to-Site VPN on IKEv2 with Both Tunnels Configured | static-validated |
How to choose
Every one of these negotiates from a built-in proposal list unless you pin one, and the built-in lists still carry old groups for compatibility - so compare what each lets you pin, then how many tunnels a gateway gives you and whether BGP is on the table at the SKU you can afford. Throughput ceilings differ by an order of magnitude between tiers.
When not to use
A VPN over the internet has the latency and jitter of the internet. If the link carries something that notices either, the dedicated interconnect products are the next step, and the VPN becomes their backup.