All checks
Low
EC2 Client VPN endpoints should have client connection logging enabled
Checks that the Client VPN endpoint logs client connections to CloudWatch Logs: each connection attempt, its result and the disconnect time, so you can tell who was on the network and when. It records connections, not traffic; what a client does inside the VPC is in VPC flow logs (EC2.6).
- service
- EC2
- severity
- Low
- scope
- evaluated in every region
How to fix it
In the console
VPC → Client VPN endpoints → the endpoint → Actions → Modify Client VPN endpoint → Connection logging
- Enable log details on client connections
- On
- CloudWatch Logs log group name
- An existing log group; create it first
- CloudWatch Logs log stream name
- Optional; Client VPN creates one if left blank
With the AWS CLI
aws ec2 modify-client-vpn-endpoint --client-vpn-endpoint-id <client-vpn-endpoint-id> --connection-log-options Enabled=true,CloudwatchLogGroup=<log-group-name> --region <region>With Terraform
resource "aws_ec2_client_vpn_endpoint" "this" {
client_cidr_block = var.client_cidr_block
server_certificate_arn = var.server_certificate_arn
authentication_options {
type = "certificate-authentication"
root_certificate_chain_arn = var.client_certificate_arn
}
connection_log_options {
enabled = true
cloudwatch_log_group = var.log_group_name
}
}See which of your accounts this check is failing on.
Book a live scan