Skip to main content

AWS VPN Tunnel Should Be Up - Security Rule

More Info:​

Ensure VPN Tunnel Is up

Risk Level​

Low

Address​

Operational Maturity, Reliability

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the issue of a VPN tunnel not being up for an AWS EC2 instance using the AWS console, follow these steps:

  1. Check VPN Configuration:

    • Go to the AWS VPC console.
    • Navigate to the Virtual Private Network (VPN) section.
    • Check the configuration of the VPN connection associated with your EC2 instance.

  2. Check Customer Gateway Configuration:

    • Verify the configuration of the Customer Gateway associated with the VPN connection.
    • Ensure that the Customer Gateway is properly configured with the correct IP address and routing information.

  3. Check Virtual Private Gateway Configuration:

    • Verify the configuration of the Virtual Private Gateway associated with the VPN connection.
    • Ensure that the Virtual Private Gateway is properly attached to the VPC and has the correct routing information.

  4. Check Security Group Rules:

    • Go to the EC2 console.
    • Navigate to the Security Group associated with your EC2 instance.
    • Ensure that the security group allows the necessary traffic for the VPN connection (e.g., UDP port 500 for IKE, UDP port 4500 for IPsec NAT traversal).

  5. Check Route Table:

    • Go to the VPC console.
    • Navigate to the Route Table associated with your VPC.
    • Ensure that the route table has the necessary route entries for the VPN connection (e.g., route to the Virtual Private Gateway).

  6. Check Network ACLs:

    • Go to the VPC console.
    • Navigate to the Network ACL associated with your subnet.
    • Ensure that the Network ACL allows the necessary traffic for the VPN connection.

  7. Check VPN Tunnel Status:

    • Go to the VPC console.
    • Navigate to the VPN Connections section.
    • Check the status of the VPN tunnel associated with your EC2 instance. If it is down, try restarting the tunnel.

  8. Update VPN Configuration:

    • If all the above steps are correct and the VPN tunnel is still not up, you may need to update the VPN configuration with the correct settings.

  9. Monitor VPN Connection:

    • Monitor the VPN connection for any changes in status.
    • Use CloudWatch logs or VPN connection monitoring tools to track the status of the VPN tunnel.

By following these steps and ensuring that all the configurations are correct, you should be able to remediate the issue of a VPN tunnel not being up for your AWS EC2 instance using the AWS console.

Using CLI

To remediate the issue of a VPN tunnel not being up for an AWS EC2 instance using the AWS CLI, you can follow these step-by-step instructions:

  1. Identify the VPN Connection: First, you need to identify the VPN connection associated with the EC2 instance. You can do this by listing the VPN connections in your AWS account using the following command:

    aws ec2 describe-vpn-connections

  2. Check VPN Connection Status: Verify the status of the VPN connection to ensure it is not in a down state. You can do this by running the following command and checking the State field:

    aws ec2 describe-vpn-connections --vpn-connection-ids <vpn-connection-id>

  3. Check VPN Gateway Status: Check the status of the VPN gateway associated with the VPN connection. You can do this by running the following command:

    aws ec2 describe-vpn-gateways

  4. Check Route Table: Ensure that the route table associated with the EC2 instance has the correct route entry for the VPN connection. You can do this by running the following command:

    aws ec2 describe-route-tables --filters Name=vpc-id,Values=<vpc-id>

  5. Update Security Group: Make sure that the security group associated with the EC2 instance allows traffic through the VPN tunnel. You can update the security group rules using the following command:

    aws ec2 authorize-security-group-ingress --group-id <security-group-id> --protocol all --port -1 --cidr <cidr-block>

  6. Restart VPN Connection: If all the configurations are correct and the VPN tunnel is still not up, you can try restarting the VPN connection. You can do this by running the following command:

    aws ec2 restart-vpn-connection --vpn-connection-id <vpn-connection-id>

  7. Monitor VPN Connection: Monitor the VPN connection status to ensure that the tunnel comes up successfully. You can do this by running the following command in a loop:

    while true; do aws ec2 describe-vpn-connections --vpn-connection-ids <vpn-connection-id>; sleep 10; done

By following these steps and ensuring that all the configurations are correct, you should be able to remediate the issue of a VPN tunnel not being up for an AWS EC2 instance using the AWS CLI.

Using Python

To remediate the issue of a VPN tunnel not being up for an AWS EC2 instance using Python, you can follow these steps:

Step 1: Install the required Python libraries Ensure that you have the necessary Python libraries installed to interact with AWS services. You can use the boto3 library for this purpose. You can install it using pip:

pip install boto3

Step 2: Create a Python script to check and bring up the VPN tunnel Create a Python script that will check the status of the VPN tunnel and bring it up if it is down. Here's an example script to achieve this:

import boto3

ec2 = boto3.client('ec2')

# Specify the instance ID of the EC2 instance with the VPN tunnel
instance_id = 'YOUR_INSTANCE_ID'

# Describe the status of the instance
response = ec2.describe_instances(InstanceIds=[instance_id])

# Check if the instance is running
if response['Reservations'][0]['Instances'][0]['State']['Name'] == 'running':
    print('Instance is running. Checking VPN tunnel status...')

    # Check the status of the VPN tunnel (Assuming you have a VPN connection ID)
    vpn_connection_id = 'YOUR_VPN_CONNECTION_ID'
    vpn_status = ec2.describe_vpn_connections(VpnConnectionIds=[vpn_connection_id])['VpnConnections'][0]['State']

    if vpn_status == 'available':
        print('VPN tunnel is already up.')
    else:
        print('VPN tunnel is down. Bringing it up...')
        
        # Start the VPN connection
        ec2.create_vpn_connection(VpnGatewayId='YOUR_VPN_GATEWAY_ID', CustomerGatewayId='YOUR_CUSTOMER_GATEWAY_ID', Type='ipsec.1')

        print('VPN tunnel has been brought up successfully.')
else:
    print('Instance is not running. Please start the instance first.')

Step 3: Replace placeholder values Replace the placeholder values in the script with your actual values for instance_id, vpn_connection_id, vpn_gateway_id, and customer_gateway_id.

Step 4: Run the Python script Save the script to a file (e.g., remediate_vpn_tunnel.py) and run it using Python:

python remediate_vpn_tunnel.py

This script will check the status of the EC2 instance and the VPN tunnel. If the VPN tunnel is down, it will bring it up by creating a new VPN connection.

Using Terraform
# There is no Terraform argument or resource that can force an AWS VPN tunnel "UP" or
# perform the diagnostic `describe-vpn-connections` call; this is a runtime / device-side issue.

# You must:
# 1. Use the AWS CLI (outside Terraform) to inspect the tunnel state:
#    aws ec2 describe-vpn-connections \
#      --vpn-connection-ids VPN_CONNECTION_ID \
#      --region AWS_REGION
#
# 2. Review the VgwTelemetry.Status / StatusMessage output and fix the
#    customer gateway (on‑prem / third‑party device): pre‑shared key, IKE/IPsec
#    parameters, routing, and firewall rules so the tunnel can establish.

# Example Terraform for the VPN connection itself (configuration only, not tunnel state):

resource "aws_vpn_connection" "example" {
  customer_gateway_id = aws_customer_gateway.example.id
  vpn_gateway_id      = aws_vpn_gateway.example.id

  type = "ipsec.1"

  static_routes_only = false

  # Configure these to match exactly what you put on the customer gateway device.
  tunnel1_preshared_key = "REPLACE_WITH_STRONG_SHARED_SECRET_1"
  tunnel1_inside_cidr   = "169.254.10.0/30"

  tunnel2_preshared_key = "REPLACE_WITH_STRONG_SHARED_SECRET_2"
  tunnel2_inside_cidr   = "169.254.20.0/30"

  # Add any other required tunnel options that must match your device profile.
}

resource "aws_customer_gateway" "example" {
  bgp_asn    = 65000
  ip_address = "REPLACE_WITH_CUSTOMER_GATEWAY_PUBLIC_IP"
  type       = "ipsec.1"
}

resource "aws_vpn_gateway" "example" {
  vpc_id = "REPLACE_WITH_VPC_ID"
}

This finding cannot be remediated directly in Terraform because Terraform cannot change or control the tunnel’s runtime status; it can only ensure the AWS-side configuration matches what you configure on your customer gateway. To verify after correcting the device-side settings, run terraform plan (no changes expected if configuration is already correct) and then use aws ec2 describe-vpn-connections to confirm the tunnel status is UP.