How would you connect an on premises data center to a cloud VPC?

A site to site VPN over the internet is quick to stand up, encrypted and cheap, but bandwidth and latency depend on the public internet. A dedicated connection gives consistent throughput and lower latency at higher cost and a lead time of weeks. Many organizations run the dedicated link with VPN as automatic backup. Whichever you choose, plan non overlapping address ranges, routing, and DNS resolution in both directions before you start.

There are two real options. A site to site VPN goes over the internet, takes an afternoon, and is fine for modest, tolerant traffic, but you inherit whatever the internet is doing that day. A dedicated circuit gives predictable bandwidth and latency, which you need for chatty protocols or bulk transfer, but it costs more and provisioning takes weeks, so it is never the answer to an urgent problem. The common landing point is the dedicated link as primary with a VPN configured as automatic failover, which is cheap insurance for a circuit that will eventually be cut by somebody with a digger. Before any of that I want the addressing sorted, because if the on premises range overlaps the VPC range you are into network address translation workarounds forever. Routing has to propagate both ways and be filtered so I am not advertising more than intended. DNS is the part that gets forgotten: cloud workloads need to resolve internal names and the reverse, so I set up forwarding rules in both directions. Once more than a couple of VPCs need this, it all goes through a transit hub rather than a mesh of peers.