Establish Hybrid Cloud Network Connectivity

This skill establishes secure, reliable network connectivity between on-premises data centers and cloud providers. For AWS it covers Site-to-Site VPN (IPSec over internet, up to 1.25 Gbps per tunnel, cost-effective but higher latency) with a Terraform example wiring an aws_vpn_gateway, aws_customer_gateway, and aws_vpn_connection, and Direct Connect (a dedicated 1-100 Gbps connection, lower latency, more expensive with setup time). For Azure it covers Site-to-Site VPN via azurerm_virtual_network_gateway (RouteBased, VpnGw1 SKU) and ExpressRoute (private connection up to 100 Gbps via a connectivity provider, premium tier for global reach). For GCP it covers Cloud VPN (IPSec, HA VPN at 99.99% SLA, up to 3 Gbps per tunnel) and Cloud Interconnect (Dedicated at 10 or 100 Gbps, Partner at 50 Mbps to 50 Gbps). It defines three hybrid network patterns - hub-and-spoke through a Transit Gateway or vWAN fanning to production/staging/development VPCs, multi-region hybrid via Direct Connect to two regions with cross-region peering, and multi-cloud hybrid connecting on-premises to AWS, Azure, and GCP simultaneously - plus BGP routing configuration (AS numbers, CIDR advertisement, route propagation and filtering) and high-availability patterns: dual VPN tunnels via redundant aws_vpn_connection resources, and active-active configuration with BGP failover and ECMP routing across multiple locations.

Use it to connect on-premises infrastructure to the cloud, extend a datacenter to the cloud, implement hybrid active-active setups, meet compliance requirements, or migrate to the cloud gradually. It does not apply outside hybrid cloud networking - a different domain or tool is out of scope. It relates to separate multi-cloud-architecture and terraform-module-library skills.

Inputs: on-premises network topology, bandwidth and latency requirements, and target cloud provider(s). Outputs: Terraform-provisioned VPN gateways/connections or a Direct Connect/ExpressRoute/Interconnect setup, a chosen hybrid topology (hub-and-spoke, multi-region, or multi-cloud), BGP routing configuration, and dual-tunnel or active-active redundancy. It tracks key monitoring metrics (tunnel status, bytes in/out, packet loss, latency, BGP session status) and troubleshooting commands (aws ec2 describe-vpn-connections, az network vpn-connection show).

AWS Direct Connect and Site-to-Site VPN, Azure ExpressRoute and VPN Gateway, GCP Cloud Interconnect and Cloud VPN, Terraform for provisioning, BGP for dynamic routing, and cloud-native monitoring (CloudWatch, Azure Monitor).

# AWS VPN
aws ec2 describe-vpn-connections
aws ec2 get-vpn-connection-telemetry

# Azure VPN
az network vpn-connection show
az network vpn-connection show-device-config-script

Network and platform engineers connecting on-premises data centers to AWS, Azure, or GCP who need to choose between VPN and dedicated connectivity, design a hybrid topology, and configure redundant, monitored connections.