AWS DX High Resiliency (2 links) with 4 On-premises routers (2 sites) and VPN backup - Design discussion

Hi subreddit,

I got a question about this design. My architecture consists of 2 data centres (DC1 & DC2), higher-ups decide to purchase only 2 Direct Connect links (in different locations, connecting to each of my site), with intention to purchase additional links as required later on (due to limited budget and pandemic).

Each pair of routers, logically, will connect to a CX router in each DX location.

So my idea of the topology is to have each of the Direct Connect link connected to a L2 stacked switch in each site, which provide L2 connectivity between my routers in each DC as well.

• Does the VIF support /29 subnet?
• Or, what if I were to create different VIFs (different 802.1Q tag) for each of my routers within a site? I'm more incline to this design.
• Is it possible or wise to peer with my AWS network using our public AS? Since the public AS is already used for the DMZ BGP routers (not the same pair in question) and in production.

The final goal is to set up DX for each site as the primary connection, with private BGP advertising each DC's private subnets, and a summary route of both DCs and receiving our AWS VPC routes.

• If one DC's DX failed, use the other DX
• Both locations will also have Internet connection for setting up VPNs, and private BGP peering will also be established over VPN
• Failover order for DC1: DX1 > DX2 > VPN1 > VPN2

Is this gonna be a valid design?