While preparing for the AWS SAA-C03, many candidates get confused by hybrid connectivity options. In the real world, this is fundamentally a decision about Network Capacity vs. Operational Cost. Let’s drill into a simulated scenario.
The Scenario #
TechFabric Industries operates a mission-critical inventory management system in their on-premises data center. The application generates time-sensitive operational data (sensor logs, quality control images, transaction records) totaling 500GB daily, which must be backed up to Amazon S3 for compliance and disaster recovery.
As production volume has tripled over 18 months, employees now experience severe internet slowdowns during backup windows (2-6 PM daily). Video conferencing drops, SaaS applications timeout, and the IT director receives escalating complaints. The current 1 Gbps shared internet connection has become a bottleneck.
Key Requirements #
Design a long-term, scalable solution that ensures timely S3 backups while eliminating impact on employee internet usage.
The Options #
- A) Establish an AWS Site-to-Site VPN connection and route all backup traffic through a VPC Gateway Endpoint to S3.
- B) Provision a new AWS Direct Connect connection and route backup traffic through this dedicated link.
- C) Order AWS Snowball devices daily, load backup data onto the devices, and ship them to AWS each day.
- D) Submit a support ticket through the AWS Management Console requesting removal of S3 service limits on the account.
Correct Answer #
Option B.
The Architect’s Analysis #
Correct Answer #
Option B — Establish AWS Direct Connect for dedicated hybrid connectivity.
Step-by-Step Winning Logic #
This is a long-term bandwidth allocation problem, not a configuration or service limit issue. Direct Connect provides:
- Dedicated Network Capacity: A private 1 Gbps or 10 Gbps link that does not share bandwidth with employee internet traffic.
- Predictable Performance: Consistent latency and throughput, critical for time-sensitive data.
- Scalability: As data volume grows, you can upgrade port speed or add additional connections.
- Cost Efficiency at Scale: Data transfer out via Direct Connect ($0.02/GB for the first 10TB) is cheaper than internet egress for sustained workloads.
The Financial Justification:
- Productivity Cost: 200 employees losing 30 min/day = 100 hours/day = ~$5,000/month in lost productivity (at $50/hr blended rate).
- Direct Connect Cost: ~$300/month (port) + $0.02/GB × 15TB/month = $300 + $300 = $600/month.
- ROI: Positive from month one when factoring in productivity recovery.
The Traps (Distractor Analysis) #
Why not Option A (VPN + VPC Gateway Endpoint)? #
- Bandwidth Misconception: VPN connections still use the internet connection—they provide encryption and routing, not additional capacity. The 1 Gbps bottleneck remains.
- Gateway Endpoint Misunderstanding: VPC Gateway Endpoints allow private connectivity to S3 from within a VPC, but they don’t solve the on-premises bandwidth problem.
- Exam Trap: Confuses candidates who know VPN is cheaper but miss that it doesn’t create new capacity.
Why not Option C (Daily Snowball Shipments)? #
- Operational Nightmare: Snowball is designed for one-time migrations or offline edge processing, not daily operational backups.
- Lead Time: Snowball requires ordering (2-3 days), loading, and shipping—incompatible with “time-sensitive data.”
- Cost at Scale: At $300/shipment (10TB device), daily use = $9,000/month vs. $600 for Direct Connect.
- Use Case Mismatch: Snowball is for petabyte-scale infrequent transfers, not recurring operational workflows.
Why not Option D (Support Ticket for S3 Limits)? #
- Non-Existent Problem: There are no account-level “backup limits” to S3 that would cause this symptom. S3 scales automatically.
- Root Cause Confusion: This option tests whether you understand the difference between network congestion and service quotas.
- Exam Red Flag: “Submit a support ticket” is rarely the correct answer for architectural design questions—it’s a procedural action, not a design.
The Architect Blueprint #
Diagram Note: Direct Connect creates a separate physical path for backup traffic, completely isolating it from the shared internet connection used by employees.
The Decision Matrix #
| Option | Est. Complexity | Est. Monthly Cost | Pros | Cons |
|---|---|---|---|---|
| A) VPN + Gateway Endpoint | Low | ~$40/month (VPN connection) | Simple to configure; low upfront cost | Does not add bandwidth; still shares internet link; doesn’t solve core problem |
| B) Direct Connect ✅ | Medium | ~$600/month (1Gbps port + data transfer) | Dedicated capacity; predictable performance; scalable; lower data transfer costs | Higher monthly cost; 1-2 week setup time; requires compatible router |
| C) Daily Snowball | Very High | ~$9,000/month ($300/day) | No network dependency | Operationally infeasible for daily use; 2-4 day turnaround; extremely expensive at scale |
| D) Support Ticket | N/A | $0 | — | Not a valid solution; no S3 limits are causing this issue |
FinOps Note: While Direct Connect has a higher baseline cost, the true cost of Option A includes hidden productivity loss (~$5,000/month), making it 8x more expensive in total cost of ownership.
Real-World Practitioner Insight #
Exam Rule #
“For the SAA-C03 exam, when you see ’long-term solution’ + ‘high-volume data transfer’ + ‘on-premises to AWS’, always prefer AWS Direct Connect over VPN or Snowball. The keyword ’long-term’ disqualifies one-time migration tools.”
Real World #
In production environments, we’d likely:
- Implement a phased approach: Start with VPN for immediate relief while Direct Connect is provisioned (1-2 week lead time).
- Right-size the connection: Use AWS’s Data Transfer Calculator to determine if 1 Gbps or 10 Gbps is optimal based on growth projections.
- Consider Direct Connect Gateway: If the company has multiple VPCs or plans multi-region expansion, this allows one DX connection to serve multiple destinations.
- Leverage S3 Transfer Acceleration temporarily during DX setup to reduce upload times over the existing internet link.
- Evaluate hybrid storage solutions: AWS Storage Gateway (File Gateway mode) could cache frequently accessed data on-premises while automatically tiering to S3, reducing the backup window.
Operational Tip: Many enterprises negotiate hybrid pricing with Direct Connect partners at colocation facilities, reducing the port cost by 30-50% compared to AWS’s published rates.