title: Why public VIF must be used in AWS Direct Connect + VPN setup?
body: <p>I am unsure why public VIF must be used in <a href="https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-vpn.html" rel="nofollow noreferrer">AWS Direct Connect + VPN</a> setup. Usually if you are connecting to Virtual Private Gateway you should use private VIF as shown in <a href="https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-managed-vpn-1.html" rel="nofollow noreferrer">AWS Managed VPN</a>. Why public VIF must be used in this case?</p>
  <p>Diagram on AWS Direct Connect + VPN:</p>
  <p><a href="https://i.stack.imgur.com/rLNEy.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/rLNEy.png" alt="AWS Direct Connect + VPN" /></a></p>
  <p>Diagram on AWS Managed VPN:</p>
  <p><a href="https://i.stack.imgur.com/K3xGV.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/K3xGV.png" alt="AWS Managed VPN" /></a></p>
  <p><strong>Edit 1:</strong><br>
  Got a better understanding by watching <a href="https://www.youtube.com/watch?v=qmKkbuS9gRs" rel="nofollow noreferrer">AWS re:Invent 2018: AWS VPN Solutions (NET304)</a>. We need public VIF because AWS Site-to-Site VPN creates two public endpoints on a Virtual Private Gateway which are visible to public VIF only. Diagram from that talk:
  <a href="https://i.stack.imgur.com/LXTuH.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/LXTuH.png" alt="VPN over DX" /></a></p>