Connect AWS and Azure with a Site-to-Site VPN

By Kokil Thapa | Last reviewed: September 2026

When you run production workloads in both AWS and Azure, private connectivity beats public endpoints every time. To Connect AWS and Azure with a Site-to-Site VPN, you build IPSec tunnels between an AWS Virtual Private Gateway or Transit Gateway and an Azure VPN Gateway. The work is mostly planning: non-overlapping CIDR blocks, correct gateway SKUs, and routing that survives failover. This guide walks through the full setup with commands, Terraform snippets, and the mistakes I see on real multi-region deployment projects.

Why would you Connect AWS and Azure with a Site-to-Site VPN?

Public internet paths between clouds add latency, expose traffic, and complicate compliance. A site-to-site VPN encrypts traffic with IKEv2 and IPSec. It is the standard first step before dedicated circuits like AWS Direct Connect paired with Azure ExpressRoute.

Common use cases I encounter on client projects include:

• Replicating databases between AWS RDS and Azure Database for MySQL or PostgreSQL
• Calling internal APIs from a Laravel app on EC2 to a Symfony service on Azure App Service
• Centralising backups from Azure Blob Storage to AWS S3 over private routes
• Gradual migration from one cloud without rewriting DNS and firewall rules overnight

For PHP teams comparing platforms first, read GCP vs AWS vs Azure for PHP workloads before committing budget to dual-cloud networking.

What do you need before setting up AWS-Azure VPN?

Skip planning and you will rebuild gateways later. Gather these items before touching the console.

Non-overlapping IP address space

AWS and Azure networks must use distinct CIDR blocks. Overlap breaks routing even if tunnels come up. A typical split:

• AWS VPC: 10.0.0.0/16
• Azure VNet: 172.16.0.0/16
• On-prem or office (if any): 192.168.0.0/16

Document every subnet before deployment. Teams that skip this step often collide with default ranges in managed services.

Gateway sizing and cost awareness

Azure VPN Gateway SKU controls throughput and whether you can use active-active mode. AWS charges per VPN connection hour plus data transfer. For Nepal startups budgeting dual cloud, see budgeting AWS and Azure in NPR. Expect roughly Rs 15,000–40,000/month (~USD 110–295) for basic dual-tunnel setups before data charges.

Shared secret and optional BGP ASN

You need a strong pre-shared key for IKE authentication. For dynamic routing, pick private BGP ASNs: AWS defaults to 64512, Azure often uses 65515. Static routes work for small setups but BGP scales better.

How do you configure Azure VPN Gateway for AWS peering?

Build the Azure side first. VPN Gateway creation takes longer than the AWS resources.

1. Create a VNet with address space 172.16.0.0/16.
2. Add a GatewaySubnet named exactly GatewaySubnet with at least /27 (prefer /26).
3. Deploy a route-based VPN Gateway. Start with VpnGw1 for production pilots.
4. Note the public IP assigned to the gateway. AWS needs this value.
5. Create a Local Network Gateway with AWS VPC CIDR 10.0.0.0/16 and placeholder peer IP.
6. Create a Connection using IPSec with your pre-shared key.

Azure CLI example

az group create --name rg-hybrid-prod --location eastus

az network vnet create \
  --resource-group rg-hybrid-prod \
  --name vnet-prod \
  --address-prefix 172.16.0.0/16 \
  --subnet-name default \
  --subnet-prefix 172.16.1.0/24

az network vnet subnet create \
  --resource-group rg-hybrid-prod \
  --vnet-name vnet-prod \
  --name GatewaySubnet \
  --address-prefix 172.16.255.0/26

az network public-ip create \
  --resource-group rg-hybrid-prod \
  --name pip-vpngw \
  --allocation-method Static \
  --sku Standard

az network vnet-gateway create \
  --resource-group rg-hybrid-prod \
  --name vpngw-prod \
  --public-ip-address pip-vpngw \
  --vnet vnet-prod \
  --gateway-type Vpn \
  --vpn-type RouteBased \
  --sku VpnGw1 \
  --vpn-gateway-generation Generation1

az network local-gateway create \
  --resource-group rg-hybrid-prod \
  --name lng-aws-vpc \
  --gateway-ip-address 0.0.0.0 \
  --local-address-prefixes 10.0.0.0/16

az network vpn-connection create \
  --resource-group rg-hybrid-prod \
  --name conn-aws \
  --vnet-gateway1 vpngw-prod \
  --local-gateway2 lng-aws-vpc \
  --shared-key "YourStrongPresharedKey2026!" \
  --use-policy-based-traffic-selectors false

Replace the placeholder 0.0.0.0 in Local Network Gateway after AWS tunnel outside IPs are known. For Infrastructure as Code, mirror this in Azure Bicep or combine both clouds in Terraform for AWS and Azure.

How do you configure AWS VPN to connect with Azure?

With Azure gateway public IP in hand, configure AWS resources in the same region as your VPC.

Step 1: Create a Customer Gateway

The Customer Gateway represents Azure's public endpoint. Use BGP if you plan dynamic routing.

aws ec2 create-customer-gateway \
  --type ipsec.1 \
  --public-ip AZURE_VPN_GATEWAY_PUBLIC_IP \
  --bgp-asn 65515 \
  --tag-specifications 'ResourceType=customer-gateway,Tags=[{Key=Name,Value=cgw-azure-prod}]'

Step 2: Attach a Virtual Private Gateway

aws ec2 create-vpn-gateway --type ipsec.1 \
  --tag-specifications 'ResourceType=vpn-gateway,Tags=[{Key=Name,Value=vgw-prod}]'

aws ec2 attach-vpn-gateway \
  --vpn-gateway-id vgw-xxxxxxxx \
  --vpc-id vpc-xxxxxxxx

For multi-VPC AWS estates, Transit Gateway is cleaner. It centralises routing the same way Azure Route Server does for hub-spoke VNets.

Step 3: Create the VPN Connection

aws ec2 create-vpn-connection \
  --type ipsec.1 \
  --customer-gateway-id cgw-xxxxxxxx \
  --vpn-gateway-id vgw-xxxxxxxx \
  --options TunnelOptions=[{PreSharedKey=YourStrongPresharedKey2026!},{PreSharedKey=YourStrongPresharedKey2026!}]

Download the AWS configuration template for your firewall type. Azure accepts the tunnel outside IP addresses and pre-shared keys from this file. Official reference: AWS Site-to-Site VPN documentation.

Step 4: Enable route propagation

aws ec2 enable-vgw-route-propagation \
  --route-table-id rtb-xxxxxxxx \
  --gateway-id vgw-xxxxxxxx

Confirm Azure-side routes point 10.0.0.0/16 to the VPN Gateway. Without bidirectional routes, one-way ping success is a common false positive.

If your app tier lives on EC2, pair this guide with deploying Laravel on AWS EC2 with RDS for a complete stack picture.

Which IPSec settings must match on both sides?

AWS and Azure negotiate IKE and IPSec automatically in most cases. Mismatched policies are the top reason tunnels stay down with vague "connecting" status.

Align these parameters:

• IKE version: IKEv2 preferred
• Encryption: AES-256
• Integrity: SHA-256
• DH group: 14 or higher
• IPSec protocol: ESP
• PFS: enabled (group 14+)
• Mode: tunnel mode, not transport

Azure route-based gateways work with AWS route-based VPN connections. Do not mix policy-based selectors unless both sides explicitly support it. Microsoft documents supported combinations in the Azure VPN device configuration guide.

How do you verify and troubleshoot the AWS-Azure VPN?

Tunnel status "UP" only means IKE finished. Application traffic can still fail on security groups or missing routes.

Verification checklist

1. AWS Console → VPC → Site-to-Site VPN Connections → both tunnels show UP.
2. Azure Portal → VPN Gateway → Connections → Connected status.
3. From an AWS EC2 instance, ping an Azure VM private IP in the peer CIDR.
4. Run traceroute and confirm the path stays internal, not via public hops.
5. Test the actual port your service uses, not just ICMP.

AWS CLI tunnel status

aws ec2 describe-vpn-connections \
  --vpn-connection-ids vpn-xxxxxxxx \
  --query 'VpnConnections[0].VgwTelemetry'

Azure connection metrics

az network vpn-connection show \
  --resource-group rg-hybrid-prod \
  --name conn-aws \
  --query connectionStatus

Store tunnel configs in version control as JSON. Use the JSON formatter to diff AWS downloaded configs against what Azure expects before applying changes.

Security group and NSG rules

VPN connectivity does not bypass host firewalls. Allow inbound traffic on application ports from the remote CIDR. On AWS, update security groups. On Azure, update NSGs on the VM subnet.

For comparison with non-IPSec alternatives, read Cloudflare Tunnel vs traditional VPN. Tunnels suit HTTP services. Site-to-site VPN suits full network peering.

Should you automate AWS-Azure VPN with Terraform?

Manual console setup works once. Production teams should codify it. Terraform manages both providers in one pipeline.

resource "aws_customer_gateway" "azure" {
  bgp_asn    = 65515
  ip_address = azurerm_public_ip.vpn_gw.ip_address
  type       = "ipsec.1"
}

resource "aws_vpn_connection" "azure" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.azure.id
  type                = "ipsec.1"
  static_routes_only  = false
}

resource "azurerm_virtual_network_gateway_connection" "aws" {
  name                = "conn-aws"
  location            = azurerm_resource_group.prod.location
  resource_group_name = azurerm_resource_group.prod.name
  type                = "IPsec"
  virtual_network_gateway_id = azurerm_virtual_network_gateway.main.id
  local_network_gateway_id   = azurerm_local_network_gateway.aws.id
  shared_key                 = var.vpn_preshared_key
}

Wire this into CI/CD with Terraform and Azure DevOps pipelines. Store the pre-shared key in AWS Secrets Manager or Azure Key Vault, not in plain Terraform state. See managing secrets with AWS Secrets Manager for rotation patterns.

For similar cross-cloud work, the AWS to GCP networking guide follows the same IPSec principles with different console names.

Key Takeaways

• Plan non-overlapping CIDR blocks before creating any gateway; overlaps cannot be fixed without redeployment.
• Build Azure VPN Gateway first, then AWS Customer Gateway and VPN Connection using Azure's public IP.
• Configure both IPSec tunnels and verify bidirectional routes, not just tunnel UP status.
• Match IKEv2, AES-256, SHA-256, and PSK exactly on AWS and Azure sides.
• Open security groups and NSGs for remote CIDR traffic on application ports, not only ICMP.
• Codify the setup in Terraform and store pre-shared keys in a secrets manager for production.

People Also Ask

Can AWS and Azure communicate over a private connection without public internet?

A standard Site-to-Site VPN encrypts traffic but still traverses the public internet between cloud edge endpoints. For fully private paths, you need AWS Direct Connect paired with Azure ExpressRoute through a colocation partner or use a third-party cloud exchange. VPN remains the fastest and cheapest starting point for most teams.

How long does it take to set up AWS-Azure Site-to-Site VPN?

AWS resources provision in minutes once you have the Azure public IP. Azure VPN Gateway creation takes 30 to 45 minutes. Including CIDR planning, route configuration, and testing, budget half a day for a first setup. Repeat deployments with Terraform take under an hour.

Does Site-to-Site VPN support BGP between AWS and Azure?

Yes. Enable BGP on the AWS Customer Gateway and use a route-based Azure VPN Gateway. BGP exchanges routes dynamically when subnets change. Static routes work for small fixed networks but require manual updates when you add CIDR blocks.

What throughput can you expect from AWS-Azure VPN?

AWS Virtual Private Gateway supports up to 1.25 Gbps per tunnel. Azure throughput depends on SKU: VpnGw1 handles about 650 Mbps, VpnGw3 up to 1.25 Gbps, and VpnGw5 up to 10 Gbps. Aggregate both tunnels where active-active is configured, but plan for single-tunnel failover at half capacity.

Production-ready hybrid cloud starts with correct VPN plumbing

To Connect AWS and Azure with a Site-to-Site VPN, treat routing and CIDR planning as day-one architecture work. Tunnels are the easy part. Bidirectional routes, matching IPSec policies, and firewall rules determine whether your Laravel API on AWS actually reaches the Azure backend at 2 a.m.

I have wired similar hybrid paths on production deployments where uptime mattered more than console novelty. If you need help designing multi-cloud networking, migrating workloads, or hardening cross-cloud API traffic, review the Adventure Third Pole Trek platform work and our enterprise application development and Linux system administration services. For cloud platform selection, see AWS vs Azure vs Google Cloud in 2026. Need hands-on help? Contact us to scope your hybrid cloud VPN project.