How would you securely connect an on-premises data center to a VPC, and when would you reach for Direct Connect instead of a Site-to-Site VPN?

Core Summary

A Site-to-Site VPN is fast to set up, encrypted by default, and runs over the public internet, which is also its ceiling: bandwidth and latency aren't guaranteed. Direct Connect is a dedicated physical link with predictable performance, but it takes weeks to provision and isn't encrypted on its own. Most serious hybrid setups end up running both.