A cross-connect is a physical connection between two designated endpoints, commonly installed through patch panels in a colocation facility. For hybrid-cloud networking, it may connect a customer's router or a telecommunications carrier's equipment to a cloud provider's network port. It is usually a passive cable path rather than a routing service. Although cross-connects can use different media, dedicated cloud interconnects commonly require single-mode optical fiber.
The cross-connect is only one segment of the complete path. An enterprise might purchase a carrier circuit from its headquarters to a cloud connectivity location, then order a facility cross-connect from the carrier's termination point to the cloud provider's assigned port. An enterprise with its own router in that facility can instead connect from its router's designated termination point. A cloud connectivity location is not necessarily a cloud Region or an Availability Zone, and ordering a cloud port does not automatically order the enterprise access circuit or facility cabling.
Provisioning normally begins with a port assignment and authorization documentation. For an AWS Direct Connect dedicated connection, the Letter of Authorization and Connecting Facility Assignment, or LOA-CFA, authorizes the connection and identifies the assigned facility endpoint. The customer supplies this document to the colocation operator or connectivity provider responsible for installing the cross-connect. Engineers must confirm the correct facility, cage or rack, patch panel, port identifiers, media, and document validity. The document authorizes physical work; it does not establish routing or prove that installation is complete.
Hardware compatibility is essential. The router interface, optical transceiver, fiber type, connector, wavelength, and Ethernet standard must match the handoff specification. For example, a 10-Gbps handoff requiring 10GBASE-LR optics must not be equipped with short-reach multimode optics merely because both transceivers fit the same interface slot. Engineers should also check fiber polarity, connector cleanliness, optical transmit and receive levels, and the supported link settings. Where patch panels are involved, the entire optical path must meet the required loss budget.
Commission the connection from the physical layer upward. First confirm that the cross-connect is installed at the assigned endpoints and that the router sees a stable link with acceptable optical levels and error counters. Then configure the required Ethernet encapsulation, VLANs, IP addressing, and BGP sessions. For example, an AWS Direct Connect port can have a working physical link while its virtual interface has incorrect VLAN tagging or its BGP session remains down. Conversely, changing BGP policies will not repair a disconnected fiber or incompatible optic.
Resilience requires independent failure paths, not merely multiple logical interfaces. Two VLANs on one cross-connect still share its fiber and port. Two separate cables can also share a patch panel, conduit, carrier entrance, router, or facility. Designs should assess these shared risks and use diverse equipment, physical paths, and connectivity locations where availability requirements justify the cost. Link aggregation adds capacity and can tolerate some member failures, but does not by itself eliminate facility-level failures.
Cross-connects introduce installation lead times, facility charges, and operational coordination, but provide a controlled physical handoff for dedicated connectivity. They do not inherently provide encryption, routing, or guaranteed end-to-end application performance. Encryption must be designed separately, such as supported MACsec on an eligible connection or an IPsec overlay. Troubleshooting and change procedures should clearly assign responsibility for the customer equipment, carrier circuit, facility cabling, and cloud port.
AWS Direct Connect