EC2 VPN connections should use IKEv2 protocol

How to fix it

Restrict every tunnel on the connection to IKEv2 only. Listing ikev2 alongside ikev1, which is what AWS configures unless you say otherwise, does not pass: the tunnel will still negotiate IKEv1 whenever the peer asks for it. Check the device at the far end speaks IKEv2 first, or it will stop connecting. Each tunnel is changed separately and AWS warns that modifying one interrupts traffic over it for several minutes. EC2.171 changes the same tunnels.

In the console

VPC → Site-to-Site VPN connections → the connection → Actions → Modify VPN tunnel options → IKE versions

With the AWS CLI

aws ec2 modify-vpn-tunnel-options --vpn-connection-id <vpn-connection-id> --vpn-tunnel-outside-ip-address <tunnel-outside-ip> --tunnel-options '{"IKEVersions":[{"Value":"ikev2"}]}' --region <region>

With Terraform

resource "aws_vpn_connection" "this" {
  customer_gateway_id  = var.customer_gateway_id
  transit_gateway_id   = var.transit_gateway_id
  type                 = "ipsec.1"
  tunnel1_ike_versions = ["ikev2"]
  tunnel2_ike_versions = ["ikev2"]
}