If Advanced Networking is about controlling traffic, AWS Direct Connect is about the road it travels on. It is one of five connection options under Pega Cloud Secure Connect, and it is the one clients reach for when the public internet is not an acceptable path between their data center and Pega Cloud — for reasons of latency, bandwidth, predictability, or policy.
What it means
Direct Connect with a public virtual interface (VIF) establishes a dedicated network connection from your enterprise and connected networks to Pega Cloud running in AWS, over public connections.
The word “public” causes confusion, so it is worth being precise. A public VIF uses internet-routable IP addresses, but traffic does not traverse the public internet. It travels a private, dedicated path between your network and Pega Cloud. “Public” describes the address space, not the route. The result is a stronger security posture and far more predictable connection behaviour than internet transit.
One hard constraint: as of April 2022, Pega Cloud environments are incompatible with AWS Direct Connect private VIF services. Public VIF is the supported pattern.
What it does
- Low up-front and ongoing maintenance cost relative to other dedicated-connectivity models.
- An SLA from AWS backing the connection, for high reliability.
- Low latency compared with internet transit.
- High bandwidth support, from 50 Mbps up to 100 Gbps.
It also gives you reach beyond Pega: the same connection can be used to access other public AWS resources, across multiple cloud providers.
How it works
This is a client-owned build, and that is the most important thing to communicate early. Pega enables the pattern; your organization implements it.
Getting the circuit. Unless you already have a presence in an AWS Direct Connect location, the usual route is a third-party provider. Your organization works with an approved AWS Direct Connect Delivery Partner to deploy the connection and perform the required configuration.
Account separation. Terminate Direct Connect public VIFs in a dedicated AWS account, separate from the one hosting the Pega Cloud application. This improves network management and enforces clear boundaries between environments. Pega does not provide an AWS account for this purpose, and does not approve VIF termination requests sent to the account hosting the Pega Cloud application.
Components to configure. A connection — hosted or dedicated both work — provisioned in the same region as your Pega Cloud. Then a public VIF, most commonly created by your organization on a Direct Connect connection you own, though some delivery partners offer a hosted VIF service. From there, design and configure your network and equipment around it: IP addressing, routing, security, and BGP.
Ongoing ownership. You maintain the uptime and availability of the Direct Connect connection and the public VIF.
What to remember
- Lead time is the number one planning risk. Establishing a new Direct Connect connection requires lead time and a moderate-to-high level of technical complexity. This is a programme workstream, not a configuration task.
- If complexity is the blocker, Cloud Exchange is the alternative. Providers such as Equinix Fabric and Megaport MCR are supported under Secure Connect and can assist with implementation details — same class of outcome, more hand-holding.
- Private VIF is not an option. If a client asks for it, redirect to public VIF, PrivateLink, or GCP Private Service Connect depending on their topology.
- Control the peering. Public VIF and Cloud Exchange both benefit from deliberate BGP design — see the Pega guidance on controlling public peering access.
- It pairs well with Advanced Networking. Add static inbound IP addresses and you can route to a specific Pega location rather than an entire IaaS region.
Technical documentation: Public connectivity using AWS Direct Connect public virtual interface
Related: Pega Cloud Secure Connect: your access to Pega Cloud