# AWS connectivity path decision matrix (2026)

Score each row 0–2; highest column sum is the primary path. Ties: prefer least privilege (Verified Access over Client VPN for HTTPS apps).

| Scenario | Site-to-Site VPN (VGW or TGW) | Accelerated S2S (TGW only) | Client VPN | Verified Access (ZTNA) | Direct Connect |
|----------|-------------------------------|----------------------------|------------|------------------------|----------------|
| Datacenter / branch ↔ VPC hybrid | **2** | **2** if internet path is lossy | 0 | 0 | **2** if steady high bandwidth |
| Remote workforce HTTPS internal apps | 0 | 0 | 1 | **2** | 0 |
| Thick client / RDP / broad subnet access | 0 | 0 | **2** | 1 (TCP endpoints if applicable) | 0 |
| Multi-VPC / multi-account hybrid hub | **2** via TGW | **2** | 1 | 0 | **2** + TGW |
| Need Global Accelerator edge for VPN | 0 on VGW | **2** | 0 | 0 | N/A |
| Backup path for DX | **2** | 1 | 0 | 0 | primary |

## Opinionated defaults

1. **Site ↔ AWS:** Site-to-Site on **Transit Gateway** when you have 3+ VPCs or multi-account; VGW only for a single VPC starter.
2. **Accelerated VPN:** only on **TGW**; cannot enable on an existing connection — recreate ([docs](https://docs.aws.amazon.com/vpn/latest/s2svpn/accelerated-vpn.html)).
3. **Humans to apps:** prefer **Verified Access** for HTTPS; keep **Client VPN** for thick clients and broad subnet needs.
4. **DX:** graduate when VPN bandwidth/jitter SLOs fail — not as day-one default for every hybrid.

## When NOT to

- Do not put all employee traffic on Client VPN full-tunnel “for security” without a cost and egress model.
- Do not use Accelerated VPN with DX public VIF — not supported.
- Do not treat Verified Access as a Site-to-Site replacement for datacenter CIDRs.