EC2 VPN connections should have logging enabled

How to fix it

• Interrupts service: Saving tunnel options interrupts traffic over that tunnel for up to several minutes, so change one tunnel at a time and set IKE versions for EC2.183 in the same save.

In the console

VPC → Site-to-Site VPN connections → the connection → Actions → Modify VPN tunnel options

VPN tunnel outside IP address

Each tunnel in turn: the setting is per tunnel, and both need it

Tunnel activity log

Enable

Amazon CloudWatch log group

Any; a name like /aws/vendedlogs/vpn keeps the CloudWatch Logs resource policy under its size limit

With the AWS CLI

aws ec2 modify-vpn-tunnel-options --vpn-connection-id <vpn-connection-id> --vpn-tunnel-outside-ip-address <tunnel-outside-ip> --tunnel-options '{"LogOptions":{"CloudWatchLogOptions":{"LogEnabled":true,"LogGroupArn":"<log-group-arn>"}}}' --region <region>

With Terraform

resource "aws_vpn_connection" "this" {
  customer_gateway_id = var.customer_gateway_id
  transit_gateway_id  = var.transit_gateway_id
  type                = "ipsec.1"
  tunnel1_log_options {
    cloudwatch_log_options {
      log_enabled   = true
      log_group_arn = var.log_group_arn
    }
  }
  tunnel2_log_options {
    cloudwatch_log_options {
      log_enabled   = true
      log_group_arn = var.log_group_arn
    }
  }
}