Back to Checks
aws

AWS Site-to-Site VPN connection has both tunnels up

vpc_vpn_connection_tunnels_up
Service: vpcSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsEc2ClientVpnEndpoint

AWS Site-to-Site VPN connections have two IPsec tunnels. This evaluates tunnel status and detects when any tunnel is not UP, indicating whether both tunnels are concurrently available for high availability.

Prowler logoProwlerprowler-provider-aws

Risk

With only one active tunnel or none, the link loses redundancy, degrading availability and increasing the chance of outages, session drops, or route blackholing. Failover cannot occur, disrupting critical workloads and cross-environment operations.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks vpc_vpn_connection_tunnels_up

Recommendation

Maintain both tunnels healthy and ready for failover:

  • Deploy redundant customer gateways and resilient routing
  • Monitor tunnel health with alerts
  • Periodically test failover and document runbooks

Apply high availability and defense-in-depth to avoid single points of failure.

Remediation

Other

1In the AWS Console, go to VPC > Site-to-Site VPN connections and select the VPN connection with a tunnel DOWN
2Open the Tunnel details tab
3For each tunnel (1 and 2), choose Actions > Download configuration, select your device/vendor, and download the config
4On your customer gateway device, configure BOTH tunnels using the downloaded parameters (pre-shared key, IKE/IPsec settings, inside CIDR, and routing/BGP as applicable)
5If your device requires different parameters, in the AWS console choose Actions > Modify VPN tunnel options, select the tunnel outside IP, adjust only the necessary options (for example IKE version or pre-shared key), and Save
6Wait a few minutes and verify both tunnels show Status: UP under Tunnel details

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class vpc_vpn_connection_tunnels_up(Check):
    def execute(self):
        findings = []
        for vpn_connection in vpc_client.vpn_connections.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=vpn_connection)

            if (
                vpn_connection.tunnels[0].status != "UP"
                or vpn_connection.tunnels[1].status != "UP"
            ):
                report.status = "FAIL"
                report.status_extended = (
                    f"VPN Connection {vpn_connection.id} has at least one tunnel DOWN. "
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"VPN Connection {vpn_connection.id} has both tunnels UP. "
                )

            findings.append(report)

        return findings

References