A company has two redundant active-passive AWS Direct Connect connections between its VPC workloads and on-premises data center. After an outage on one Direct Connect connection, failover to the secondary took more than a minute. The company wants failover to occur in seconds. Which change will produce the LARGEST reduction in BGP failover time?

Enabling Bidirectional Forwarding Detection (BFD) on the on-premises router is the most effective solution. BFD is a lightweight protocol that quickly detects failures in the forwarding path between two routing devices. When BFD is enabled on both sides of the Direct Connect connection (AWS and on-premises), it can detect a link failure in milliseconds, significantly reducing BGP convergence time compared to the default BGP hold-down timer, which is typically 180 seconds. Reducing the BGP hold-down timer on the VIFs alone is insufficient because the on-premises router's timer would still dictate the failover speed. Creating a CloudWatch alarm and Lambda function is a reactive measure that would trigger after a failure is detected, not proactively accelerate the detection itself. Enabling BFD only on the AWS side is also insufficient; BFD requires configuration on both ends of the connection to function correctly.