Question

A global enterprise operates a Transit Gateway spanning three AWS Regions with dozens of VPC and VPN attachments managed under a single AWS Cloud WAN / Network Manager global network. The operations team wants a proactive alert whenever a Site-to-Site VPN tunnel associated with any attachment changes state (up/down) or when BGP routing convergence issues occur, without writing custom polling scripts against each individual VPN connection. Which approach best meets this requirement?

Accepted Answer

Enable Network Manager, which publishes topology and routing change events (including VPN tunnel state and BGP status) to Amazon CloudWatch Events/EventBridge, and create EventBridge rules that trigger SNS notifications on the relevant events.

Answer

Configure VPC Flow Logs on every attachment's subnets and build a CloudWatch Logs metric filter that detects when tunnel packet counts drop to zero.

Answer

Run Reachability Analyzer on a scheduled basis for each attachment pair and alarm when a path analysis returns 'not reachable'.

Answer

Enable Transit Gateway Flow Logs and create a CloudWatch alarm on the TunnelState dimension exported automatically by the flow log records.