AWS–Azure Private Interconnect Preview: What Proxy Egress Teams Must Retest

Amazon Web Services announced on August 31, 2026 that AWS Interconnect – multicloud connectivity with Microsoft Azure had entered public preview. The managed service is designed to provision dedicated private bandwidth between the two cloud environments without customers arranging physical circuits themselves.

For teams operating proxy-backed data collection, market research, ad verification or regional testing, the announcement changes the middle of a network path, not the evidence required at its end. Private cloud-to-cloud connectivity can simplify transit and improve resilience, but it does not automatically prove which cloud owns public egress, whether a workload used the intended proxy, where TLS terminates, or whether failure caused a direct Internet fallback.

What AWS announced

AWS describes the preview as an on-demand private connectivity model between AWS and Azure. The initial Azure preview is available in US East (Northern Virginia), US West (Northern California), Asia Pacific (Sydney) and Europe (Frankfurt).

The service provisions four independent logical paths across physically diverse facilities and routers. AWS says this quad-redundant design is intended to continue carrying traffic through maintenance and multiple independent disruptions, including a site loss scenario.

AWS also states that MACsec protects data between the edge routers of the two cloud providers. Network Synthetic Monitor is included to help detect packet loss and determine whether a problem originates on the AWS side.

These are useful infrastructure properties. They do not replace application-level controls or a workload-specific proxy test.

Redraw the complete egress path

A multi-cloud proxy route can now include:

1. workload process in the source cloud;
2. source subnet, virtual network and internal security controls;
3. private multicloud interconnect;
4. destination-cloud virtual network or inspection layer;
5. NAT, firewall or explicit proxy configuration;
6. commercial proxy gateway;
7. selected proxy exit;
8. authorized public destination.

Document every hop, route owner, encryption mechanism, DNS resolver, source-address transformation, monitoring signal and failure behavior. Mark the boundary where private interconnect protection ends and the public proxy segment begins.

Do not claim that a private intercloud link makes the entire proxy transaction private.

Decide which cloud owns public egress

The architecture must have an explicit answer for every workload:

• Does an AWS workload cross to Azure before reaching a proxy gateway?
• Does an Azure workload cross to AWS for centralized inspection and egress?
• Are both clouds allowed to egress independently?
• Which route is preferred during normal operation?
• What happens when the private link is impaired?
• Can a default route bypass the inspection or proxy layer?

Route tables, dynamic routing, firewall rules, private DNS and proxy environment variables can disagree. Validate the effective route from the application process, not only the intended cloud diagram.

MACsec has a defined boundary

AWS describes MACsec encryption between provider edge routers. That protects the interconnect segment, but it is not the same as application-to-proxy or application-to-destination TLS.

For an HTTPS proxy gateway, continue to verify:

• the application connects to the expected proxy hostname;
• certificate-chain and hostname validation are enabled;
• the approved TLS policy is negotiated;
• proxy authentication fails closed;
• CONNECT behavior matches the product design;
• traffic after the interconnect remains protected as required;
• credentials are not exposed in flow logs, shell output or support artifacts.

For SOCKS5, remember that routing and encryption are separate. SOCKS5 alone does not encrypt the application payload.

Revalidate DNS

Moving a workload across a private interconnect can change which resolver answers the proxy gateway name and which addresses it returns. Test:

1. the resolver used in each cloud;
2. split-horizon or private-zone behavior;
3. A and AAAA answers independently;
4. cache lifetime during route changes;
5. remote DNS behavior for supported SOCKS configurations;
6. whether a stale answer points to an unreachable or unintended gateway.

Record resolver and answer classes without storing unnecessary customer or destination data.

Test all four failure layers

The four logical interconnect paths improve infrastructure resilience, but proxy workflows have additional failure layers.

Interconnect impairment

Verify how routing converges when one path, router or site becomes unavailable. Measure interruption time, packet loss, connection resets and recovery.

Inspection or egress failure

Disable a controlled firewall, NAT or proxy canary and prove that traffic cannot silently use a direct route.

Commercial proxy failure

Simulate gateway timeout, authentication rejection and TLS validation failure. Retries must remain bounded and must not switch to an unapproved direct connection.

Destination response change

Separate network failure from destination rate limits, access rules and content changes. A fast block page is not a successful route.

Correlate infrastructure and application evidence

Network Synthetic Monitor can help locate packet loss on the AWS portion, but a proxy incident record should also contain:

operation_id
source_cloud
source_region
intended_egress_cloud
interconnect_path_state
proxy_gateway_alias
proxy_route_verified
direct_fallback_blocked
tls_validation_result
observed_exit_market
first_attempt_result
retry_count
total_latency_ms

Use aliases and sanitized identifiers. Do not put passwords, tokens, cookies, personal data or full sensitive URLs in routine telemetry.

Build a preview acceptance gate

Before using the preview for a production proxy path, require a controlled evaluation:

• the required source and destination regions are supported;
• each workload has one documented normal egress path;
• route preference is verified from the application;
• the interconnect encryption boundary is documented;
• proxy and destination TLS are tested independently;
• DNS answers are validated from both clouds;
• IPv4 and IPv6 are tested separately when both are in scope;
• single-path, router and site impairment scenarios are observed;
• proxy, NAT and inspection failures cannot create direct fallback;
• monitoring correlates infrastructure loss with application outcomes;
• latency, first-attempt success and cost meet the workload threshold;
• the team has an approved rollback path.

Because the Azure connectivity is in public preview, validate current regional, capacity, support and availability conditions before relying on it for critical traffic.

Operations checklist

• [ ] The complete source-to-destination proxy path is diagrammed.
• [ ] Public egress ownership is explicit for every workload.
• [ ] Private interconnect and public Internet segments are not conflated.
• [ ] MACsec and TLS boundaries are separately documented.
• [ ] Effective routes are tested from application processes.
• [ ] DNS behavior is checked in both clouds.
• [ ] Proxy credentials are excluded from diagnostics.
• [ ] Direct fallback is blocked and tested.
• [ ] Retry limits remain stable during failover.
• [ ] Exit market and content validity are rechecked after route changes.
• [ ] Infrastructure and application telemetry share a correlation ID.
• [ ] Preview limitations and rollback are recorded.

For supporting controls, use the 98IP guides on proxy failover recovery drills, validating proxy provider SLAs, and checking proxy location accuracy.

FAQ

Does the AWS–Azure interconnect replace a proxy service?

No. It provides private connectivity between cloud environments. Internet egress, filtering, commercial proxy selection and destination access remain separate architectural decisions.

Does MACsec make the public proxy connection encrypted end to end?

No. AWS describes MACsec between provider edge routers. Application TLS and the proxy-to-destination segment still require independent verification.

Can four interconnect paths prevent every proxy outage?

No. They address interconnect resilience. DNS, routing, firewall, NAT, proxy gateway, authentication, TLS and destination failures remain possible.

Should failover switch directly to the public Internet?

Not unless that behavior is explicitly authorized and designed. For proxy-required workloads, direct fallback should normally be blocked and tested.

Compliance note

Use multicloud and proxy infrastructure only for lawful, authorized workloads. Respect destination terms, robots instructions, privacy duties, consent requirements and rate limits. Private connectivity and encryption do not create permission to access restricted systems. Do not use failover, alternate clouds or proxy rotation to evade an access decision.

Source note: Amazon Web Services, “AWS and Microsoft Azure collaborate to expand multicloud networking,” published August 31, 2026.