Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Connecting to RISE using Amazon VPN

Enable access from your remote network to the RISE with SAP VPC using Amazon Site-to-Site VPN. Amazon Site-to-Site VPN encrypts traffic between the Amazon Cloud and your on-premises location using Internet Protocol Security (IPsec) and transfers it through a secure tunnel over the internet. This option is faster to implement than a dedicated private connection such as Amazon Direct Connect. For more information, see Connect your VPC to remote networks using Amazon Virtual Private Network.

You can configure the bandwidth capacity for your VPN tunnels with one of these two options:

By default, each VPN connection includes two tunnels.

For more information, see Tunnel options for your Amazon Site-to-Site VPN connection.

Standard bandwidth: Up to 1.25 Gbps per tunnel

The following diagram shows the architecture for a standard bandwidth Site-to-Site VPN connection to the RISE with SAP VPC.

When using this option, SAP requires the following details and handles the Amazon-side configuration on your behalf:

You can obtain these details from your on-premises Amazon VPN device.

For redundancy, configure a second VPN connection.

Pricing example 1: Single 1.25 Gbps Site-to-Site VPN connection

A Site-to-Site VPN connection is created and connected directly to the RISE Account VPC in US East (Ohio). The connection is active for 30 days, 24 hours a day, with 1 TB transferred.

The total estimated monthly cost is approximately USD 119.16.

When you connect your remote network directly to RISE using Amazon Site-to-Site VPN, the RISE subscription covers the Amazon VPN Connection and data transfer out costs.

Large Bandwidth Tunnel: Up to 5 Gbps per tunnel

With Large Bandwidth Tunnels, you can configure Site-to-Site VPN tunnels that support up to 5 Gbps bandwidth per tunnel, compared to the standard 1.25 Gbps. For more information, see Large Bandwidth Tunnels.

Large Bandwidth Tunnels work only with VPN connections attached to a Transit Gateway or Amazon Cloud WAN. They do not work with Virtual Private Gateways, so you cannot use them to connect directly from your remote network to the RISE with SAP VPC. To use Large Bandwidth Tunnels, route traffic through your own Amazon managed account. For more information on this architecture pattern, see Connecting to RISE using your single Amazon account.

The following diagram shows the architecture for a Large Bandwidth Tunnel VPN connection through your own Amazon account to the RISE with SAP VPC.

When using this option, you are responsible for the configuration. For more information, see Create an Amazon Site-to-Site VPN connection and Introducing Amazon Site-to-Site VPN 5 Gbps tunnels to support high-throughput workloads.

Because you are using your own Amazon account in this option, these costs are not included in the RISE subscription.

Pricing example 2: Single 5 Gbps Site-to-Site VPN

Create a Large Bandwidth Site-to-Site VPN connection in your Amazon VPC, terminating in an Amazon Transit Gateway in US East (Ohio). The connection is active for 30 days, 24 hours a day, with 1 TB transferred.

The total estimated monthly cost is approximately USD 571.64.

For more information, see Amazon Site-to-Site VPN pricing.

Because you connect via VPN to your own Amazon account, which is then connected to the RISE account, these costs are split between you and the RISE subscription, depending on the direction of data traffic.

To scale beyond the 5 Gbps throughput of a single Large Bandwidth Tunnel, see Achieve ECMP routing with multiple Site-to-Site VPN tunnels associated with a transit gateway.

Summary

For a full decision tree on how to connect to RISE on Amazon, see Decision tree on connectivity to RISE.