Share DirectConnect with another AWS account via DXGW

Question

HI, the documentation is a bit confusing, that's why I have couple of questions please. What I'm trying to achieve is to share our DX connections with our other AWS accounts withing the same Organization. I'm intending to use private VIFs for that, but correct me if I'm wrong:"
1- I will use the DX gateway to extend the DX connection to our other AWS accounts. is the virtual gateway in account B assiciation to our DXGW in account A enough? or that still requires creating private VIFS from the DXGW (in account A) first then accept it in account B first? which happens first? (I hope my question isn't confusing)
2- if I create private VIFs at account A on behalf of account B, do I still (in that case) need to create a virtual gateway in account B? I will be connecting VPCs to access S3 buckets vua private links (initially).

Thank you in advance

re:Post Agent · Answer

To share your Direct Connect connections with other AWS accounts within your organization, you have a couple of options:

1. Using Direct Connect Gateway with Virtual Private Gateway associations:
- Account A (DX owner) creates a Direct Connect Gateway
- Account B creates a Virtual Private Gateway and attaches it to their VPC
- Account B creates an "association proposal" to connect their Virtual Private Gateway to Account A's Direct Connect Gateway
- Account A accepts the association proposal
- This allows Account B to route traffic from their VPC through Account A's Direct Connect connection

The association proposal is what links the Virtual Private Gateway in Account B to the Direct Connect Gateway in Account A. The owner of the Direct Connect Gateway (Account A) must accept this proposal for the connection to be established. The proposal can include prefixes that will be allowed from the Virtual Private Gateway, which Account A can optionally override.

2. Using hosted private virtual interfaces:
- Account A (DX owner) creates a hosted private virtual interface specifically for Account B
- Account B accepts the hosted virtual interface
- When accepting, Account B can choose to attach it either to a Virtual Private Gateway or to a Direct Connect Gateway in their account
- Yes, Account B would still need a Virtual Private Gateway attached to their VPC to use the hosted private virtual interface

For your specific scenario of connecting VPCs to access S3 buckets via private links, either approach would work, but the Direct Connect Gateway with Virtual Private Gateway associations might be more scalable if you're planning to connect multiple accounts.  
**Sources**  
[AWS Direct Connect virtual private gateway associations - AWS Direct Connect](https://docs.aws.amazon.com/directconnect/latest/UserGuide/virtualgateways.html)  
[Associate an AWS Direct Connect virtual private gateway across accounts - AWS Direct Connect](https://docs.aws.amazon.com/directconnect/latest/UserGuide/multi-account-associate-vgw.html)  
[Hosted AWS Direct Connect virtual interfaces - AWS Direct Connect](https://docs.aws.amazon.com/directconnect/latest/UserGuide/hosted-vif.html)  
[AWS Direct Connect gateways - AWS Direct Connect](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html)

Share DirectConnect with another AWS account via DXGW

Add your answer

Relevant content