Direct Connect peering between on-prem and virtual aplliances

    Thank you for your question, Michael. To address your inquiry about Direct Connect peering between on-premises routers and virtual network appliances in a VPC:

    Unfortunately, it is not possible to attach a Private Virtual Interface (VIF) directly to virtual network appliances within a VPC. Private VIFs must be attached to either a Virtual Private Gateway (VGW), a Transit Gateway, or a Direct Connect Gateway.

    The standard architecture for connecting on-premises networks to AWS resources via Direct Connect involves using one of these gateway types as an intermediary. These gateways serve as the entry point for traffic coming from your on-premises network into your AWS environment.

    For your use case of creating a transit hub between AWS resources and your on-premises data center, you have a few options:

    1. Use a Virtual Private Gateway: You can attach a VGW to your VPC and connect your Direct Connect Private VIF to it. This would allow communication between your on-premises network and resources in that specific VPC.

    2. Implement a Transit Gateway: This is a more scalable option if you need to connect multiple VPCs or have complex routing requirements. You can attach your VPCs to the Transit Gateway and then connect the Transit Gateway to your Direct Connect connection via a Direct Connect Gateway.

    3. Use a Direct Connect Gateway: This global resource allows you to connect to multiple VPCs across different regions using a single Direct Connect connection. You would associate your VPCs' Virtual Private Gateways with the Direct Connect Gateway.

    While these options don't allow for direct peering between your virtual appliances and on-premises routers, they provide secure and manageable ways to establish the connectivity you need. You would then configure your virtual network appliances to route traffic appropriately within your VPC and to/from the chosen gateway.

    Remember to consider factors such as scalability, routing complexity, and your overall network architecture when choosing the best approach for your specific requirements.
  

Sources
AWS Direct Connect with private VIF over virtual private gateway - AWS Prescriptive Guidance
AWS Direct Connect + AWS Site-to-Site VPN - Amazon Virtual Private Cloud Connectivity Options