Establish Hybrid Cloud Network Connectivity

A skill for configuring secure, high-performance connectivity between on-premises datacenters and AWS, Azure, and GCP. Compares connection options per provider: AWS Site-to-Site VPN (IPSec, up to 1.25 Gbps per tunnel, internet-dependent) versus Direct Connect (dedicated, 1-100 Gbps, lower latency); Azure Site-to-Site VPN versus ExpressRoute (private connection via a connectivity provider, up to 100 Gbps); and GCP Cloud VPN (Classic or HA VPN with a 99.99% SLA, up to 3 Gbps per tunnel) versus Cloud Interconnect (Dedicated at 10 or 100 Gbps, or Partner at 50 Mbps to 50 Gbps). Documents three hybrid network topologies: hub-and-spoke (on-prem through VPN or Direct Connect to a Transit Gateway or vWAN fanning out to production, staging, and dev VPCs), multi-region hybrid (separate Direct Connect links per region joined by cross-region peering), and multi-cloud hybrid (Direct Connect to AWS, ExpressRoute to Azure, and Interconnect to GCP simultaneously). Covers BGP routing configuration (AS numbers, CIDR advertisement, route propagation and filtering), high availability via dual VPN tunnels with BGP-driven automatic failover and ECMP routing, and a ten-item security checklist covering private connectivity preference, VPN tunnel encryption, VPC endpoints and PrivateLink to avoid internet routing, network ACLs and security groups, flow log monitoring, DDoS protection, and regular audits. Monitoring guidance names the key metrics to watch (tunnel status, bytes in and out, packet loss, latency, BGP session status) and the exact CLI commands for troubleshooting, such as aws ec2 describe-vpn-connections and az network vpn-connection show. Cost guidance covers right-sizing connections, using VPN for low-bandwidth workloads, and consolidating traffic through fewer connections.

Use when connecting an on-premises datacenter to the cloud, extending a datacenter into cloud capacity, building a hybrid active-active setup, meeting a compliance requirement for private connectivity, or migrating to cloud gradually while both environments run side by side. Not for pure cloud-native networking with no on-prem component, and not for the architecture decision of which cloud or multi-cloud strategy to adopt in the first place - that's the sibling multi-cloud-architecture skill; this one is the connectivity implementation layer underneath that decision.

Input is the on-prem-to-cloud connectivity requirement: target provider or providers, bandwidth needs, latency tolerance, and compliance constraints. Output is Terraform HCL for the chosen connection type (VPN gateway, customer gateway, VPN connection, or virtual network gateway), a routing and BGP configuration, a redundancy design (dual tunnels or multi-path), and a monitoring and cost-optimization plan.

resource "aws_vpn_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags = {
    Name = "main-vpn-gateway"
  }
}

resource "aws_customer_gateway" "main" {
  bgp_asn    = 65000
  ip_address = "203.0.113.1"
  type       = "ipsec.1"
}

resource "aws_vpn_connection" "main" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.main.id
  type                = "ipsec.1"
  static_routes_only  = false
}

Covers AWS (VPN Gateway, Direct Connect), Azure (Virtual Network Gateway, ExpressRoute), and GCP (Cloud VPN, Cloud Interconnect) natively, provisioned via Terraform, and links to companion skills multi-cloud-architecture for architecture decisions and terraform-module-library for the underlying IaC modules.

Network and cloud engineers building or hardening hybrid connectivity between an on-premises datacenter and one or more cloud providers, who need concrete Terraform, BGP, and security configuration rather than a conceptual overview.