EC2 Client VPN endpoint logs client connections

Check ID: ec2_client_vpn_endpoint_connection_logging_enabled
Provider: AWS
Service: ec2
Severity: LOW
Categories: logging
Resource type: AwsEc2ClientVpnEndpoint

What this check verifies

AWS Client VPN endpoints are evaluated for client connection logging that records client connect/disconnect events to CloudWatch Logs. The evaluation detects endpoints where this logging is disabled.

Risk

Without Client VPN connection logs, remote access lacks an audit trail, reducing detection and accountability.

Stolen credentials can be used unnoticed
Lateral movement and data exfiltration persist Impacts confidentiality and integrity; delayed investigation can degrade availability.

Recommendation

Enable client connection logging on all Client VPN endpoints and send events to a centralized log group.

Enforce least privilege on log access
Define retention and immutability
Integrate with monitoring/alerts
Separate VPN operations from log administration
Review anomalous login patterns

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 modify-client-vpn-endpoint --client-vpn-endpoint-id <CLIENT_VPN_ENDPOINT_ID> --connection-log-options Enabled=true,CloudWatchLogGroup=<CLOUDWATCH_LOG_GROUP_NAME>

# Terraform: enable connection logging on a Client VPN endpoint
resource "aws_ec2_client_vpn_endpoint" "<example_resource_name>" {
  server_certificate_arn = "arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>"
  client_cidr_block      = "10.0.0.0/22"

  authentication_options {
    type                       = "certificate-authentication"
    root_certificate_chain_arn = "arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>"
  }

  connection_log_options {                # CRITICAL: enables client connection logging
    enabled             = true            # CRITICAL: turns on logging
    cloudwatch_log_group = "<example_resource_name>"  # CRITICAL: destination log group
  }
}

# CloudFormation: enable connection logging on a Client VPN endpoint
Resources:
  <example_resource_name>:
    Type: AWS::EC2::ClientVpnEndpoint
    Properties:
      ClientCidrBlock: 10.0.0.0/22
      ServerCertificateArn: arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>
      AuthenticationOptions:
        - Type: certificate-authentication
          MutualAuthentication:
            ClientRootCertificateChainArn: arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>
      ConnectionLogOptions:               # CRITICAL: enables client connection logging
        Enabled: true                     # CRITICAL: turns on logging
        CloudWatchLogGroup: <example_resource_name>  # CRITICAL: destination log group

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_client_vpn_endpoint_connection_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires