Replication into AWS is free over a Site-to-Site VPN and free over Direct Connect. AWS's price list settles most of the AWS Direct Connect question for a business in Kenya putting its recovery site in Cape Town, because what you pay for is the traffic coming back, the port you rent and a circuit AWS does not price.
CloudSpinx designs recovery sites in AWS Cape Town as part of its disaster recovery work for businesses in Kenya, and the path the data takes there and back is a line in every one of those designs. Kenya also has exactly one Direct Connect location, which holds any design that stays inside the country to the 95% single-connection SLA, and no price table shows that.
What AWS sells at NBO1, and what it does not
AWS opened its Nairobi Direct Connect location, NBO1, on 3 September 2025. It was the first in Kenya and it is still the only one: the locations page lists it with dedicated 10 Gbps and 100 Gbps ports, both with MACsec, and nothing smaller. A dedicated 10 Gbps port costs USD 2.25 an hour, USD 1,642.50 a month, whether a byte crosses it or not.
Anything under 10 Gbps is a hosted connection: an AWS Delivery Partner with its own port at NBO1 provisions you a slice of it. AWS sets its own hourly line for those too, from USD 0.03 for 50 Mbps to USD 1.65 for 5 Gbps, with 1 Gbps at USD 0.33. AWS's partner page lists one partner at NBO1, approved for hosted connections from 50 Mbps to 10 Gbps. One. Whatever that partner charges for the slice sits on top of AWS's line, and AWS does not publish it.
Then come the two pieces AWS does not sell at all, the circuit from your building to NBO1 and the cross-connect inside the facility. AWS's own pricing guide lists both as billed separately, by your network provider and by the colocation provider or partner. Servers already in that building need only the cross-connect. Servers in an office in Westlands need a circuit as well, and a carrier quotes it.
- AWS publishes the price
- quoted to you, not on AWS's pages
- no new charge
The port line runs from USD 21.90 a month for a 50 Mbps hosted slice to USD 16,425 for a dedicated 100 Gbps port at AWS list rates over 730 hours. A dedicated 10 Gbps port is USD 1,642.50.
Direct Connect vs VPN, priced a month
A Site-to-Site VPN to Cape Town costs USD 0.05 per connection-hour, and each connection's two tunnels hold a public IPv4 address apiece at USD 0.005 an hour. That is USD 43.80 a month over 730 hours, with no circuit to buy, because the tunnels ride the internet line you already pay for.
Traffic into AWS costs nothing on either link while it lands on a virtual private gateway. Route it through a Transit Gateway and Cape Town charges USD 0.02 for every GB sent into it, on either link, which moves both totals and not the gap between them. Traffic out of Cape Town to the internet, which is what a VPN carries, costs USD 0.154 per GB for the first 10 TB of the month once the first 100 GB is used. The same traffic out to NBO1 over Direct Connect costs USD 0.11, from AWS's pay-as-you-go pricing and the price list behind it. The saving lives in that 4.4-cent gap.
| Link from Kenya to AWS Cape Town | AWS's fixed charge a month | Per GB out of AWS | Not on AWS's bill |
|---|---|---|---|
| Site-to-Site VPN | USD 43.80 | USD 0.154 | nothing, it rides your internet line |
| Hosted Direct Connect, 100 Mbps | USD 43.80 | USD 0.11 | the partner's charge, the circuit to it |
| Hosted Direct Connect, 1 Gbps | USD 240.90 | USD 0.11 | the partner's charge, the circuit to it |
| Dedicated Direct Connect, 10 Gbps | USD 1,642.50 | USD 0.11 | the circuit to NBO1, the cross-connect |
On AWS's lines alone, a 100 Mbps hosted connection costs exactly what the VPN does and then charges less per GB. Everything that makes that slice the dearer option is on somebody else's invoice.
Now put a recovery site on it. The stream that never stops goes in (database logs, changed blocks, last night's backup), and in costs the same on both links. What comes out is a drill that copies data back, a failback after the real thing, and staff in Kenya working against Cape Town while the primary is down. Pull 2,048 GB back after a failover and the internet rate charges USD 315.39, before the free 100 GB, where Direct Connect charges USD 225.28. USD 90.11 apart, once. A 1 Gbps hosted port costs USD 197.10 a month more than the VPN, which the per-GB saving only recovers once about 4,480 GB leave AWS every month, before the partner's charge and the circuit move that line further out. A dedicated 10 Gbps port needs about 41,300 GB a month, because past 10 TB the internet rate drops to USD 0.147 and the gap narrows to 3.7 cents.
Flat-rate pricing, added on 15 September 2026 for dedicated 10 and 100 Gbps ports, folds the egress into one hourly rate. AWS's price list prices NBO1's 10 Gbps flat rate from USD 10.96 an hour (Tier 1), about USD 8,000 a month, to USD 23.29 (Tier 3). Which tier a Cape Town VPC falls in is set on AWS's flat-rate page, so treat 10.96 as a floor. Even at that floor, roughly 57,800 GB a month has to leave AWS before flat rate beats paying per GB on the same port.
If you are not sure which side of 4,480 GB you sit on, send last month's AWS bill and the size of your nightly change through the DR scoping form and we will tell you.
One location in Kenya, and what that does to the SLA
AWS's Direct Connect SLA has three tiers. A single connection carries a 95% monthly commitment, so AWS owes a credit only after more than 36.5 hours down in a 730-hour month. The 99.9% tier needs at least two connections in at least two different Direct Connect locations. The 99.99% tier needs at least four, two in each of two locations, each on its own AWS device, plus a Well-Architected Review with an AWS solutions architect. Both multi-site tiers require an Enterprise Support plan. The SLA also says outright that none of the three applies to a hosted connection, so a slice from a partner carries no SLA from AWS at all.
Kenya has one location. Every other one is outside the country, and the African ones are in Cape Town, Johannesburg and Lagos, so a multi-site design means a second international circuit into a facility in another country. The same document says AWS does not recommend anything short of multi-site for production workloads.
- build this
- build this, and budget for it
- not a link question
The 4,480 GB line is a 1 Gbps hosted port against one VPN connection, on AWS's charges only. The partner's charge and the circuit push it further out, and AWS publishes neither.
So the shape we recommend for a primary in Kenya is Direct Connect at NBO1 only where the traffic, or servers already in the NBO1 building, justify it, with a Site-to-Site VPN behind it as the backup path. When both advertise the same prefixes, a virtual private gateway prefers the routes it learns over Direct Connect, so traffic leaving the VPC takes the VPN only while the circuit is down. Your own router needs the same preference set for the other direction. Put that VPN on a different internet provider from the circuit, on a separate physical path, because the cut that takes out both is the outage you bought two links to survive. A second line into the building on its own path is ordinary network connectivity work.
When Direct Connect earns its port
There are two cases where we would buy it. Your servers already sit in the NBO1 building, so there is no circuit to price, and a dedicated port there can run MACsec, which encrypts the cross-connect between your router and AWS's device and nothing beyond it. Or thousands of GB a month leave AWS for Kenya, because users here query a reporting database in Cape Town all day or an application already running in AWS serves them. Either way, Direct Connect does not encrypt traffic by default, and hosted connections cannot use MACsec, so for a hosted slice or a carrier circuit that has to be encrypted, IPsec on top is AWS's answer.
AWS says a private connection "can provide a more consistent network experience" than the internet. We have not measured a Direct Connect path from Nairobi, so we put no latency number on it. Throughput is a weaker argument than it sounds: a standard VPN tunnel tops out at 1.25 Gbps by AWS's quota table, so unless your internet line is faster than that, the tunnel is not what slows the first full copy.
Neither link changes where the data sits. If a rule keeps the recovery copy itself in Kenya, a faster pipe to Cape Town does not answer that, and where your servers can legally live is the question to settle before either link. What the standby itself costs is a separate sum.
If what crosses the link is replication going in and a quarterly drill coming back, take the VPN, put a second internet provider behind it and keep the money. We would say that on the first call. Past that, we price the recovery site, the link and the drills together as one monthly figure. Send the data you replicate, how much of it changes in a day, what you would pull back in a drill or a failover, and whether the primary sits in an office or a colocation facility, through the scoping form or on WhatsApp at +254 713 403 044. You get back which link fits, its monthly figure with the recovery site in it, and a straight answer on whether a circuit is worth buying at all. There is no fee for that reply and no contract behind it.