Cloud Networking
AWS Direct Connect: Hosted vs. Dedicated
A practical guide to how AWS Direct Connect reaches your network through Equinix Fabric, what Hosted and Dedicated really mean, and how to choose the right model.
Contents
- Start with the physical ownership question
- Three objects people commonly confuse
- What Hosted and Dedicated actually mean
- How the traffic paths differ
- Why one VLAN cannot become Dedicated
- Bandwidth, policing, and shaping
- Visibility and support boundaries
- Resiliency matters more than the label
- What the router configuration looks like
- Decision framework and bottom line
01Start with the physical ownership question
Most Hosted versus Dedicated discussions become confusing because they begin with VLANs, bandwidth, or BGP. The more useful starting point is physical ownership:
- Hosted connection: an AWS Direct Connect Partner allocates capacity to you from its existing connection to AWS.
- Dedicated connection: AWS assigns a physical Ethernet connection to your organization.
That distinction determines who provisions the service, who owns the AWS facing physical connection, where troubleshooting responsibility changes, which port speeds are available, and how bandwidth is enforced.
Neither model is automatically more enterprise grade. Hosted can be the correct production design when it has adequate capacity, diverse paths, clear support ownership, and tested failover. Dedicated provides more direct physical ownership, but it does not replace sound resiliency design.
02Three objects people commonly confuse
An Equinix Fabric design usually contains three separate objects. They are related, but they are not interchangeable.
| Object | What it is | What it controls |
|---|---|---|
| Equinix Fabric access port | Your physical Ethernet handoff into Equinix Fabric | The aggregate physical capacity available to your Fabric services |
| Hosted connection | Partner allocated AWS Direct Connect capacity | The purchased bandwidth and AWS connection ownership model |
| Virtual interface | The logical AWS interface carrying private, public, or transit routing | VLAN, BGP peering, address family, and attachment type |
A 100 Gbps Equinix Fabric port is not a 100 Gbps AWS Hosted connection. It is the physical access port that can carry multiple Fabric virtual connections. Each AWS Hosted connection has its own purchased bandwidth.
HundredGigE0/1/0 100 Gbps Equinix Fabric access port | + VLAN 110 AWS East Production hosted connection 10 Gbps + VLAN 120 AWS West Production hosted connection 10 Gbps + VLAN 210 AWS East Nonproduction hosted connection 2 Gbps + VLAN 310 Azure virtual connection 10 Gbps
03What Hosted and Dedicated actually mean
Hosted: an AWS Direct Connect Partner provisions the connection on your behalf. The connection is allocated from partner infrastructure and appears in your AWS account for acceptance. AWS supports Hosted connection speeds from 50 Mbps through 25 Gbps, although higher speeds are available only through qualified partners and supported locations.
Dedicated: AWS assigns a physical connection to your organization. Current Dedicated port speeds are 1 Gbps, 10 Gbps, 100 Gbps, and 400 Gbps. You order the connection from AWS and arrange the physical delivery through the colocation facility or network provider.
| Area | Hosted | Dedicated |
|---|---|---|
| AWS facing physical connection | Owned and operated through the partner model | Assigned to your organization |
| How it is requested | Through an AWS Direct Connect Partner | Through AWS |
| Supported speeds | 50 Mbps through 25 Gbps | 1, 10, 100, or 400 Gbps |
| Bandwidth enforcement | Automatically rate limited to purchased capacity | VIFs share the physical port unless rate limiters or local QoS are applied |
| Physical support boundary | Includes the partner | More direct AWS connection ownership |
The routing concepts remain familiar in either model. Both use 802.1Q VLAN tagging, BGP, and AWS virtual interfaces. The important differences are provisioning, physical ownership, capacity enforcement, telemetry, and support responsibility.
04How the traffic paths differ
With Hosted connectivity through Equinix Fabric, your router reaches AWS through the partner service path:
Cisco router | Equinix Fabric access port | Equinix Fabric virtual connection | Partner AWS interconnect | AWS Direct Connect
With Dedicated connectivity, AWS assigns the physical connection and provides an LOA CFA so the facility can connect your equipment or provider circuit to the assigned AWS port:
Cisco router or provider circuit | Facility cross connect | AWS assigned Dedicated connection | AWS Direct Connect
A Dedicated design therefore requires a distinct physical delivery path to the AWS assigned connection. Depending on the existing cabling and router capacity, this can require a new router interface, patching, optics, provider circuit, and cross connect. It should be treated as a physical build, not as a VLAN change.
05Why one VLAN cannot become Dedicated
A VLAN does not determine whether a connection is Hosted or Dedicated. The underlying AWS connection does.
If a router interface connects to Equinix Fabric, every AWS service delivered across that Fabric interface is using the partner delivery model. Creating another VLAN on that same trunk does not create a physical AWS port assigned to your company.
Existing Fabric port + VLAN 110 Hosted AWS Production + VLAN 120 Hosted AWS Nonproduction + VLAN 130 Hosted Azure service Separate physical delivery + AWS assigned port Dedicated AWS connection
06Bandwidth, policing, and shaping
Hosted connection bandwidth is an explicit service attribute. AWS applies traffic policing at the purchased capacity. When traffic exceeds that rate, excess packets can be dropped. Bursty traffic can therefore experience loss even when longer term averages appear acceptable.
The router subinterface does not automatically understand the commercial bandwidth of the Hosted connection. A 10 Gbps Hosted connection carried over a 100 Gbps parent interface still appears to the router as a subinterface of a 100 Gbps Ethernet port.
Local shaping slightly below the provider enforced rate can smooth bursts before they reach the AWS or partner policer. This is often preferable to allowing the service edge to discard excess traffic without regard to application priority.
On a Dedicated connection, virtual interfaces share the physical port by default. One busy virtual interface can consume capacity needed by another. AWS supports virtual interface rate limiters on Dedicated connections, and local QoS can also be used to control contention.
Capacity planning must account for normal load, burst behavior, application priority, growth, and the surviving load after a connection failure. A design that works only while every path is available is not resilient.
07Visibility and support boundaries
Hosted does not mean you have no visibility. You can still monitor your Cisco interface, optics, errors, drops, VLAN state, BGP, BFD, route advertisements, and AWS virtual interface metrics. AWS CloudWatch exposes virtual interface traffic, packet rate, BGP status, and prefix counters.
The limitation is the partner owned section between your Fabric handoff and AWS. If the problem occurs inside Equinix Fabric or on the partner AWS interconnect, you may see the symptoms but not the underlying physical fault. Equinix must investigate that part of the path and may need to coordinate with AWS.
Dedicated gives your organization more direct ownership of the AWS physical connection and access to connection level CloudWatch metrics associated with it. Supported connections can also expose optical light level metrics. This produces a clearer physical support boundary, but it does not provide administrative access to AWS internal switching.
| Troubleshooting area | Hosted | Dedicated |
|---|---|---|
| Your router interface and optics | Directly visible | Directly visible |
| BGP and virtual interface metrics | Available | Available |
| Partner AWS interconnect | Partner investigation required | Not part of the connection path |
| AWS physical connection metrics | Limited by the ownership model | Associated directly with your connection |
| Primary physical support path | You, partner, then AWS when required | You, facility or carrier, and AWS |
08Resiliency matters more than the label
A single Dedicated connection is still a single point of failure. A pair of properly diverse Hosted connections can be more resilient than one Dedicated connection. The design decision should therefore begin with failure domains, not branding.
For production connectivity, evaluate:
- Two independent router paths
- Separate physical ports and optics
- Diverse cross connects or Fabric paths
- Multiple AWS Direct Connect locations where required
- Independent power and facility failure domains
- BGP policy that produces deterministic failover and failback
- Enough surviving bandwidth to carry production traffic after a failure
- Documented monitoring, escalation, and incident ownership
The most important production question is usually not Hosted or Dedicated. It is whether one router, one metro, one partner interconnect, one power event, or one routing mistake can remove all AWS connectivity.
Use the AWS Direct Connect Resiliency Toolkit and its resiliency models as a planning reference. Then validate the actual design with controlled failure testing. A diagram that shows two lines is not proof that the paths are independent.
09What the router configuration looks like
At the router, Hosted and Dedicated use the same fundamental building blocks: an 802.1Q tagged interface, point to point addressing, BGP, route filtering, and optional BFD. The physical interface and operational ownership differ, but the Layer 3 concepts are familiar.
interface HundredGigE0/1/0 description EQUINIX FABRIC ACCESS 100G no ip address interface HundredGigE0/1/0.110 description AWS EAST PRODUCTION DX 10G encapsulation dot1q 110 ip address 169.254.10.1 255.255.255.252 interface HundredGigE0/1/0.120 description AWS WEST PRODUCTION DX 10G encapsulation dot1q 120 ip address 169.254.20.1 255.255.255.252
Do not interpret this as meaning the services are operationally identical. Hosted connections are provisioned through the partner and accepted in AWS. Dedicated connections are ordered from AWS, physically delivered, and then used to create one or more virtual interfaces.
Apply explicit inbound and outbound BGP policy, maximum prefix protection, documented communities, BFD where appropriate, and deterministic path preference. Do not rely on default BGP behavior to produce the intended production failover order.
10Decision framework and bottom line
Choose Hosted when the existing partner based design provides the required bandwidth, resiliency, support model, monitoring, and deployment speed. It is especially attractive when Equinix Fabric access ports are already installed and additional AWS connectivity can be provisioned without a new physical build.
Choose Dedicated when direct ownership of the AWS physical connection, higher port capacity, Dedicated specific features, or a clearer AWS support boundary justifies the additional physical delivery work and cost.
| Decision factor | Hosted tends to fit when | Dedicated tends to fit when |
|---|---|---|
| Deployment | Existing Fabric capacity is available | A new physical build is acceptable |
| Bandwidth | Per connection capacity up to 25 Gbps is sufficient | 1, 10, 100, or 400 Gbps physical capacity is required |
| Support model | Partner escalation is acceptable | Direct AWS connection ownership is preferred |
| Capacity isolation | Purchased connection rate limiting is desirable | You want to control how multiple VIFs share a physical port |
| Operational priority | Speed, flexibility, and reuse of existing infrastructure | Physical ownership, scale, and direct telemetry |
Bandwidth values in this article are expressed in bits per second. For example, 10 Gbps is ten gigabits per second, not ten gigabytes per second.