Configure DataSync for On-Premises File Replication to S3 When using Direct Connect

When using AWS Direct Connect for DataSync transfers from on-premises to S3, the most secure approach is to create a VPC endpoint for DataSync rather than using public service endpoints.

Using a VPC endpoint with AWS PrivateLink offers several security advantages:

1. It keeps all DataSync traffic private within your VPC without traversing the public internet, which enhances security for your data transfers.

2. When you activate your DataSync agent using a VPC endpoint, you'll see a green "VPC Endpoint" banner in the console, indicating that all tasks performed via this agent will use private endpoints.

3. For this setup with Direct Connect, you'll need:

• A Direct Connect gateway associated with a virtual private gateway for your VPC
• A private virtual interface connecting your VPC to the Direct Connect gateway
• A VPC endpoint for DataSync in the VPC

When you create a task using this configuration, DataSync will create four elastic network interfaces (ENIs) in your specified VPC and subnet. These ENIs handle the data transfer traffic, and you'll need to ensure your agent can reach them via port 443.

While you could use public service endpoints with Direct Connect, the VPC endpoint approach provides better security by keeping all traffic private and not exposing your data transfer to the public internet. This aligns with security best practices, especially when you already have Direct Connect established.
Sources
DataSync architecture and routing examples with AWS Direct Connect - AWS DataSync
Connecting your network for AWS DataSync transfers - AWS DataSync
Transferring files from on premises to AWS and back without leaving your VPC using AWS DataSync | AWS Storage Blog
DataSync Agent behind corporate proxy | AWS re:Post