Monitor the status of an AWS VPC VPN tunnel

Many AWS users want to connect their existing data center and networks to the cloud with a VPN. This is actually quite easy to do; more and more vendors of the equipment used in data centers can simply import the file you create when you define the VPN in your VPC to define the connection at the data center end. That allows both ends to connect with no muss, no fuss.

But if you want to check to see the status of your VPN connections as seen at the AWS end, you have to log into the AWS console, find the VPC VPN connection and navigate to a “tunnel details” tab to check the status.

Or, you can use this little PowerShell script which will show all VPNs in your VPCs along with the number and type of routes (BGP or static) for each VPN. See the output in the screen shot nearby, which I am thrilled to say was generated in PowerShell running on macOS using the AWSPowerShell.NetCore cmdlets. And, BTW, the script is actually just one (longish) statement that demonstrates how the power of the pipeline combines so masterfully with the AWS API.

Hope you enjoy this and, as always, I look forward to your feedback.

<#Copyright 2017 Air11 Technology LLC
 
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
 
    http://www.apache.org/licenses/LICENSE-2.0
 
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License. #>

Get-EC2VpnConnection | Select-Object -Property VpnConnectionId, VgwTelemetry | ` # Pass all objects to the pipeline
ForEach-Object -Process {
    
    $connectionID = $_.VpnConnectionId # get connection ID
    $_.VgwTelemetry | ForEach-Object {
        # There are multiple Amazon.Model.EC2.VgwTelemetry objects in each Amazon.Model.EC2.VPNConnection
        if (($_.status).value -ne 'UP')
        {
            Write-Host "Connection $connectionID is $(($_.status).value) and has a status message of $(($_.StatusMessage))"
            # Uncomment the next statement and change the arn to send a message to an SNS topic
            # Publish-SNSMessage -TopicArn arn:aws:sns:us-east-1:01234567890:your-SNS-topic -Subject "VPN Status Alert!" -Message "The $ConnectionID is showing it's ($_.status).value"
        }
        else
        {
            Write-Host "Connection $connectionID is $(($_.status).value) and has a status message of $(($_.StatusMessage))"
            
        }
    }
}