Question

A company runs a Site-to-Site VPN connection to AWS with two tunnels for redundancy. The network operations team wants to be automatically notified within a few minutes whenever either tunnel changes state, and they want to trigger a Lambda function that pages the on-call engineer. They must use native AWS metrics without deploying any agents. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create a CloudWatch alarm on the VPN's TunnelState metric in the AWS/VPN namespace for each tunnel, set the threshold to detect the DOWN state (value below 1), and configure the alarm action to publish to an SNS topic that invokes the Lambda function.

Answer

Install the CloudWatch agent on the customer gateway device to push tunnel status to a custom metric, then alarm on that metric and trigger the Lambda function through an SNS subscription.

Answer

Enable VPC Flow Logs on the virtual private gateway attachment and use a CloudWatch Logs metric filter to detect the absence of traffic on a tunnel, then alarm and invoke Lambda.

Answer

Schedule a CloudWatch Events rule every 5 minutes to run a Lambda function that calls DescribeVpnConnections and evaluates the tunnel status field, paging the engineer if a tunnel is down.