Back to Checks
aws

Direct Connect connections span at least two locations per region

directconnect_connection_redundancy
Service: directconnectSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

AWS Direct Connect connectivity is provisioned with connection and location redundancy-multiple connections spread across at least two distinct Direct Connect locations in each Region.

Prowler logoProwlerprowler-provider-aws

Risk

Missing connection/location redundancy creates a single point of failure, degrading availability. A router, fiber, or site outage can sever private paths to AWS, stalling app traffic, data replication, and admin access, leading to timeouts or extended downtime until alternate paths are restored.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks directconnect_connection_redundancy

Recommendation

Apply redundancy and defense in depth:

  • Deploy 2 Direct Connect connections across two distinct locations
  • Use dynamic, active/active routing for automatic failover
  • Ensure provider/device diversity
  • Size capacity so one link loss doesn't overload remaining paths
  • Consider a VPN as tertiary backup

Remediation

CLI

aws directconnect create-connection --region <REGION> --location <NEW_DX_LOCATION_CODE> --bandwidth 1Gbps --connection-name <example_resource_name>

Terraform

# Create an additional Direct Connect connection in a different location
resource "aws_dx_connection" "example" {
  name      = "<example_resource_name>"
  bandwidth = "1Gbps"
  location  = "<NEW_DX_LOCATION_CODE>" # Critical: choose a different DX location in the same Region to achieve location redundancy
}

Other

1In the AWS Console, go to Direct Connect > Connections
2Click Create connection
3Region: select the Region where the existing connection resides
4Name: enter <example_resource_name>
5Location: select a different Direct Connect location than your existing connection
6Bandwidth: choose a supported value (e.g., 1 Gbps)
7Click Create connection

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.directconnect.directconnect_client import (
    directconnect_client,
)


class directconnect_connection_redundancy(Check):
    def execute(self):
        findings = []
        if len(directconnect_client.connections):
            regions = {}
            for conn in directconnect_client.connections.values():
                if conn.region not in regions:
                    regions[conn.region] = {}
                    regions[conn.region]["Connections"] = 0
                    regions[conn.region]["Locations"] = set()
                regions[conn.region]["Connections"] += 1
                regions[conn.region]["Locations"].add(conn.location)

            for region, connections in regions.items():
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=connections
                )
                report.region = region
                report.resource_arn = directconnect_client._get_connection_arn_template(
                    region
                )
                report.resource_id = "unknown"
                if connections["Connections"] == 1:
                    report.status = "FAIL"
                    report.status_extended = (
                        "There is only one Direct Connect connection."
                    )
                else:  # Connection Redundancy is met.
                    if (
                        len(connections["Locations"]) == 1
                    ):  # All connections use the same location
                        report.status = "FAIL"
                        report.status_extended = f"There is only one location {next(iter(connections['Locations']))} used by all the Direct Connect connections."
                    else:  # Connection Redundancy and Location Redundancy is also met
                        report.status = "PASS"
                        report.status_extended = f"There are {connections['Connections']} Direct Connect connections across {len(connections['Locations'])} locations."

                findings.append(report)

        return findings

References