Back to Checks
aws

Direct Connect gateway or virtual private gateway has at least two virtual interfaces on different Direct Connect connections

directconnect_virtual_interface_redundancy
Service: directconnectSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

Direct Connect gateways and virtual private gateways are assessed for interface redundancy: multiple virtual interfaces (VIFs) distributed across more than one Direct Connect connection.

Gateways with only one VIF or with all VIFs on a single connection are identified.

Prowler logoProwlerprowler-provider-aws

Risk

Missing connection diversity undermines availability. A single device, fiber, or location failure can cut on-prem to VPC connectivity, causing outages, packet loss, or routing blackholes. Fallback to internet VPN can add latency and throttle throughput, delaying recovery and impacting operations.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks directconnect_virtual_interface_redundancy

Recommendation

Apply connectivity defense in depth:

  • Attach at least two VIFs per gateway on separate Direct Connect connections in distinct locations
  • Prefer active/active dynamic routing and size capacity to survive a link loss
  • Optionally add a VPN/Transit Gateway path to sustain operations during provider outages

Remediation

CLI

aws directconnect create-private-virtual-interface --connection-id <CONNECTION_ID_DIFFERENT_FROM_EXISTING_VIF> --new-private-virtual-interface '{"virtualInterfaceName":"<NAME>","vlan":<VLAN>,"asn":<BGP_ASN>,"addressFamily":"ipv4","amazonAddress":"<AMAZON_IP/30>","customerAddress":"<CUSTOMER_IP/30>","directConnectGatewayId":"<DIRECT_CONNECT_GATEWAY_ID>"}'

Terraform

# Create a second Private VIF on a different DX connection and attach to the gateway
resource "aws_dx_private_virtual_interface" "example" {
  connection_id   = "<example_resource_id>"      # CRITICAL: use a DIFFERENT Direct Connect connection than existing VIFs
  dx_gateway_id   = "<example_resource_id>"      # CRITICAL: attaches the VIF to the Direct Connect gateway (use virtual_gateway_id for VGW)
  name            = "<NAME>"
  vlan            = 100
  bgp_asn         = 65000
  address_family  = "ipv4"
  amazon_address  = "169.254.100.1/30"
  customer_address = "169.254.100.2/30"
}

Other

1In the AWS Console, open Direct Connect
2Go to Connections and select a different connection than the one used by your existing VIF
3Click Create virtual interface and choose Private
4For Gateway, select your Direct Connect gateway (or Virtual private gateway for VGW)
5Enter VLAN, BGP ASN, and IPv4 peer IPs (Amazon/Customer), then Create
6Verify the gateway now has at least two VIFs on different Direct Connect connections

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.directconnect.directconnect_client import (
    directconnect_client,
)


class directconnect_virtual_interface_redundancy(Check):
    def execute(self):
        findings = []
        for vgw in directconnect_client.vgws.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=vgw)
            if len(vgw.vifs) < 2:
                report.status = "FAIL"
                report.status_extended = (
                    f"Virtual private gateway {vgw.id} only has one VIF."
                )
            elif len(vgw.connections) < 2:
                report.status = "FAIL"
                report.status_extended = f"Virtual private gateway {vgw.id} has more than 1 VIFs, but all the VIFs are on the same DX Connection."
            else:
                report.status = "PASS"
                report.status_extended = f"Virtual private gateway {vgw.id} has more than 1 VIFs and the VIFs are on more than one DX connection."

            findings.append(report)

        for dxgw in directconnect_client.dxgws.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=dxgw)
            if len(dxgw.vifs) < 2:
                report.status = "FAIL"
                report.status_extended = (
                    f"Direct Connect gateway {dxgw.id} only has one VIF."
                )
            elif len(dxgw.connections) < 2:
                report.status = "FAIL"
                report.status_extended = f"Direct Connect gateway {dxgw.id} has more than 1 VIFs, but all the VIFs are on the same DX Connection."
            else:
                report.status = "PASS"
                report.status_extended = f"Direct Connect gateway {dxgw.id} has more than 1 VIFs and the VIFs are on more than one DX connection."

            findings.append(report)

        return findings

References