AWS architecture template
Hybrid network: on-premises to AWS
Site-to-site VPN into AWS Transit Gateway, an optional Direct Connect link, Route 53 Resolver and DMS database replication.
Free to start. Updated .
When to use it
Use this template while a workload runs partly in your data centre and partly on AWS, for example during a migration. The customer gateway on premises builds a site-to-site VPN with two IPsec tunnels to a Transit Gateway, which routes between the on-premises network and every attached VPC, so you do not need a VPN per VPC. An application VPC runs EC2 and RDS, and a shared services VPC holds Route 53 Resolver endpoints so names resolve in both directions, plus AWS Database Migration Service replicating the on-premises database into RDS until cut-over.
VPN over the internet is quick to set up and cheap, but bandwidth and latency vary. When the link carries production traffic, add Direct Connect as the primary path and keep the VPN as backup. Plan non-overlapping CIDR ranges across every site and VPC before you attach anything, because Transit Gateway cannot route between overlapping networks.
What's in this template
User / ActorCorporate users
VPNCustomer gateway (edge router)
DatabaseOn-premises database
Transit GatewayTransit Gateway with VPN attachment
Direct ConnectOptional dedicated link
EC2Application servers
RDSRDS database
Route 53Resolver endpoints for hybrid DNS
Database Migration ServiceReplicates the on-premises database
How it connects
- User / Actor → VPN (network): LAN
- Database → VPN (network): LAN
- VPN → Transit Gateway (network): Site-to-site VPN (2 tunnels)
- VPN → Direct Connect (network): Private connection
- Direct Connect → Transit Gateway (network): Transit VIF
- Transit Gateway → EC2 (network): VPC attachment
- Transit Gateway → Route 53 (network): VPC attachment
- EC2 → RDS (data): SQL
- Database Migration Service → RDS (data): Ongoing replication
More AWS templates
AWS 3-tier web app
CloudFront and WAF in front of an Application Load Balancer, EC2 Auto Scaling app servers, Aurora and ElastiCache in a VPC.
AWS serverless API
API Gateway with a Cognito JWT authorizer, Lambda handlers, DynamoDB storage and an SQS queue for background jobs.
AWS static website with CloudFront
Private S3 bucket behind CloudFront with origin access control, ACM, WAF and a CodePipeline build that deploys on push.
Make it your own
Open a copy in the editor, then rename, rearrange and extend it.