Option 1 - Connect Azure ExpressRoute and AWS/Other cloud provider's equivalent private connection. The customer manages routing.
Option 2 - Connect ExpressRoute and AWS/Other cloud provider's equivalent private connection. A cloud exchange provider handles routing.
Option 3 - Use site-to-site VPN over the Internet. As you said, this may not have SLA as traffic traverses over the internet.
Option1 :
long-term contracts
lock you into 18-24 month contracts
45-90 day installation windows
to increase bandwidth capacity, it might take you months
to decrease bandwidth capacity, you’ll have to live with unused circuits because of those long-term contracts
Latency is still an issue due to backhaul traffic. Even with private circuits to each cloud, you’ll still need to backhaul traffic to your data center or on-premises routing equipment.
IP Overlap
AWS Direct Connect only supports MACSec for data security, which Azure VPN Gateway doesn’t support.
Option 1 :
You can only connect an Azure virtual network to another cloud provider's virtual private cloud (VPC) if the private IP address spaces don't overlap.
Routing complexity of Azure ExpressRoute and other cloud provider equivalent with customer-managed routing can be high if not done through a cloud exchange provider.
You might need to provide DNS resolution between Azure and the other cloud provider. This configuration might incur extra costs.
if you require an SLA, if you want predictable throughput, or need to handle data volume transfer. Consider whether to use a customer-managed routing or a cloud exchange provider if you haven't implemented ExpressRoute already.
If you need to minimize latency between Azure and another cloud provider, consider deploying your application in a single virtual network with an ExpressRoute gateway, and enable FastPath.
latency between the two cloud environments, privately connected via our virtual router, is just a three-to-four-millisecond round trip. This lowest-latency path between AWS and Azure, enabled by the MCR’s direct connection, means optimal application performance.
If the need is permanent connectivity, then Megaport have a product called the Megaport Cloud Router (MCR) that sits at the edge of their network and allows users to connect between cloud providers (such as Azure ExpressRoute and AWS Direct Connect). There are certain limitations based on whether the direct connect purchased through Megaport is a hosted VIF or Hosted connection and also what is the size (is it 1G/5G/10G).
You will also have to ensure there is a well defined VPC CIDR range strategy between the AWS VPCs and Azure VPCs. Also the configuration of the on premises routes to Megaport and routes being received will have to be correctly setup.
Additional information in their docs here : https://docs.megaport.com/
Customers who use Terraform can also use the new HA BGP VPN which deploys an end to end solution from AWS to Azure and is available from here: https://registry.terraform.io/modules/aws-samples/windows-workloads-on-aws/aws/1.1.4/submodules/aws-to-azure-bgp-vpn
The Customer can setup a HA VPN between Azure and AWS to begin with and then use the 2nd solution below as they scale up their usage -
Also consider using Aviatrix You can check them also in our Marketplace
https://docs.aviatrix.com/HowTos/GettingStartedAzureToAWSAndGCP.html
Besides Megaport, Equinix Fabric provide virtual router feature to connect AWS Direct Connect to other cloud provider equivalent.
https://docs.equinix.com/en-us/Content/Interconnection/Fabric/Fabric-landing-main.htm
Notice both Megaport and Equinix provide ISV SPIF.
Create a VPN between Azure and AWS using only managed solutions
Azure to AWS and Snowflake
connect the Azure VNET -> Azure Express Route -> Megaport, and from the Megaport you connect to both AWS and SnowFlake Environment.
There are three recommended ways you can connect your Direct Connect and ExpressRoute workloads for better performance and compatibility:
Using your data center.
Advantages
Better control and customization – fine-tune your data migration to greater select which data goes where.
Expand on existing service – With this method, you can take advantage of your existing security stack as well as the network hardware and toolset you’re already familiar with to establish connectivity.
No new solution to learn or integrate into your overall network strategy.
Disadvantages
Higher costs – maintaining a data center requires continued costs of expert maintenance, rent, and more.
Time to deploy – Many times, this will require a service provider to deliver local loops into your data center, which can come with term agreements and high monthly costs. These new services typically take weeks or months to deploy.
Possible bandwidth strain – If you are using your existing network infrastructure, you’ll want to make sure you have the capacity for the throughput requirements. Latency can also be a detriment if your data center is not in the same geographic area as the ExpressRoute and Direct Connect locations.
Virtual Network Function (VNF).
Advantages
Time to deploy – You can deploy these solutions using your NaaS provider’s portal interface or API, usually within minutes. After your virtual router is up and running, deploying VXCs to ExpressRoute and Direct Connect becomes very simple.
Lower costs – By avoiding data center hairpinning, you reduce the amount of data you send out of AWS and Azure, thereby reducing hefty egress fees. We share more ways to lower your Azure egress fees on our blog.
Higher network performance – When you deploy your virtual network device close to the cloud workload region, you can enjoy higher network performance due to reduced latency and jitter.
Flexible term agreements – By using a VNF solution, you can scale up and scale down your routers as needed, as opposed to signing long-term contracts for carrier-provided MPLS circuits.
Disadvantages
Less customizable – Prepackaged solutions will have a specific feature set that may or may not be right for you, so make sure the features you need are available. Also check the specific SD-WAN or firewall vendor you want to deploy is available with that NaaS provider.
Carrier Multiprotocol Label Switching (MPLS).