Back to Checks
aws

EC2 Client VPN endpoint has client connection logging enabled

ec2_client_vpn_endpoint_connection_logging_enabled
Service: ec2Severity: low
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsEc2ClientVpnEndpoint

AWS Client VPN endpoints are evaluated for client connection logging that records client connect/disconnect events to CloudWatch Logs. The evaluation detects endpoints where this logging is disabled.

Prowler logoProwlerprowler-provider-aws

Risk

Without Client VPN connection logs, remote access lacks an audit trail, reducing detection and accountability.

  • Stolen credentials can be used unnoticed
  • Lateral movement and data exfiltration persist Impacts confidentiality and integrity; delayed investigation can degrade availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_client_vpn_endpoint_connection_logging_enabled

Recommendation

Enable client connection logging on all Client VPN endpoints and send events to a centralized log group.

  • Enforce least privilege on log access
  • Define retention and immutability
  • Integrate with monitoring/alerts
  • Separate VPN operations from log administration
  • Review anomalous login patterns

Remediation

CLI

aws ec2 modify-client-vpn-endpoint --client-vpn-endpoint-id <CLIENT_VPN_ENDPOINT_ID> --connection-log-options Enabled=true,CloudWatchLogGroup=<CLOUDWATCH_LOG_GROUP_NAME>

Terraform

# Terraform: enable connection logging on a Client VPN endpoint
resource "aws_ec2_client_vpn_endpoint" "<example_resource_name>" {
  server_certificate_arn = "arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>"
  client_cidr_block      = "10.0.0.0/22"

  authentication_options {
    type                       = "certificate-authentication"
    root_certificate_chain_arn = "arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>"
  }

  connection_log_options {                # CRITICAL: enables client connection logging
    enabled             = true            # CRITICAL: turns on logging
    cloudwatch_log_group = "<example_resource_name>"  # CRITICAL: destination log group
  }
}

NativeIaC

# CloudFormation: enable connection logging on a Client VPN endpoint
Resources:
  <example_resource_name>:
    Type: AWS::EC2::ClientVpnEndpoint
    Properties:
      ClientCidrBlock: 10.0.0.0/22
      ServerCertificateArn: arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>
      AuthenticationOptions:
        - Type: certificate-authentication
          MutualAuthentication:
            ClientRootCertificateChainArn: arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>
      ConnectionLogOptions:               # CRITICAL: enables client connection logging
        Enabled: true                     # CRITICAL: turns on logging
        CloudWatchLogGroup: <example_resource_name>  # CRITICAL: destination log group

Other

1Open the Amazon VPC console and go to Client VPN Endpoints
2Select the endpoint and choose Actions > Modify client VPN endpoint
3Under Connection logging, check Enable
4For CloudWatch log group, select an existing log group
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_client_vpn_endpoint_connection_logging_enabled(Check):
    def execute(self):
        findings = []
        for vpn_arn, vpn_endpoint in ec2_client.vpn_endpoints.items():
            report = Check_Report_AWS(metadata=self.metadata(), resource=vpn_endpoint)

            if vpn_endpoint.connection_logging:
                report.status = "PASS"
                report.status_extended = f"Client VPN endpoint {vpn_endpoint.id} in region {vpn_endpoint.region} has client connection logging enabled."
            else:
                report.status = "FAIL"
                report.status_extended = f"Client VPN endpoint {vpn_endpoint.id} in region {vpn_endpoint.region} does not have client connection logging enabled."

            findings.append(report)

        return findings

References