Site-to-Site VPN across clouds
IPsec tunnels between your network and a cloud VPC - gateway, peer definition and connection, with BGP for routes that do not go stale.
8 verified modules, 1 of them live-tested apply→verify→destroy; the rest are static-validated, live-test pending.
Compare by provider
| Provider | Module | Verification |
|---|---|---|
| Alibaba Cloud | A VPN Gateway and IPsec Connection on IKEv2 with Pinned Cryptography and Routes Written | static-validated |
| AWS | Site-to-Site VPN with Modern Crypto | static-validated |
| Azure | A Site-to-Site VPN with Modern Crypto, BGP, and a Connection | static-validated |
| Google Cloud | HA VPN (Site-to-Site) | ✓ live-tested |
| Huawei Cloud | An Active-Active VPN Gateway with a Connection from Each Public IP on IKEv2 with Pinned Cryptography | static-validated |
| IBM Cloud | A Policy-Mode VPN Gateway with Its Own IKE and IPsec Policies Pinned to Strong Cryptography | static-validated |
| Oracle Cloud | A Site-to-Site VPN on IKEv2 with Both Tunnels Configured | static-validated |
| Tencent Cloud | A VPN Gateway and Policy-Based IPsec Connection on IKEv2 with Tencent's Weak Defaults Refused | static-validated |
How to choose
Every one of these negotiates from a built-in proposal list unless you pin one, and the built-in lists still carry old groups for compatibility - so compare what each lets you pin, then how many tunnels a gateway gives you and whether BGP is on the table at the SKU you can afford. Throughput ceilings differ by an order of magnitude between tiers.
When not to use
A VPN over the internet has the latency and jitter of the internet. If the link carries something that notices either, the dedicated interconnect products are the next step, and the VPN becomes their backup.