Check ID: vpc_vpn_connection_tunnels_up
Provider: AWS
Service: vpc
Severity: MEDIUM
Categories: resilience
Resource type: AwsEc2ClientVpnEndpoint

​
What this check verifies

AWS Site-to-Site VPN connections have two IPsec tunnels. This evaluates tunnel status and detects when any tunnel is not UP, indicating whether both tunnels are concurrently available for high availability.

​
Risk

With only one active tunnel or none, the link loses redundancy, degrading availability and increasing the chance of outages, session drops, or route blackholing. Failover cannot occur, disrupting critical workloads and cross-environment operations.

​
Recommendation

Maintain both tunnels healthy and ready for failover:
  • Deploy redundant customer gateways and resilient routing
  • Monitor tunnel health with alerts
  • Periodically test failover and document runbooks
Apply high availability and defense-in-depth to avoid single points of failure.

​
Remediation

Dashboard steps
  1. In the AWS Console, go to VPC > Site-to-Site VPN connections and select the VPN connection with a tunnel DOWN
  2. Open the Tunnel details tab
  3. For each tunnel (1 and 2), choose Actions > Download configuration, select your device/vendor, and download the config
  4. On your customer gateway device, configure BOTH tunnels using the downloaded parameters (pre-shared key, IKE/IPsec settings, inside CIDR, and routing/BGP as applicable)
  5. If your device requires different parameters, in the AWS console choose Actions > Modify VPN tunnel options, select the tunnel outside IP, adjust only the necessary options (for example IKE version or pre-shared key), and Save
  6. Wait a few minutes and verify both tunnels show Status: UP under Tunnel details

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = vpc_vpn_connection_tunnels_up. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks