Monitor the status of an AWS VPC VPN tunnel

Show the status of an AWS VPN
Show the status of an AWS VPN (click to enlarge)

Many AWS users want to connect their existing data center and networks to the cloud with a VPN. This is actually quite easy to do; more and more vendors of the equipment used in data centers can simply import the file you create when you define the VPN in your VPC to define the connection at the data center end. That allows both ends to connect with no muss, no fuss.

But if you want to check to see the status of your VPN connections as seen at the AWS end, you have to log into the AWS console, find the VPC VPN connection and navigate to a “tunnel details” tab to check the status.

Or, you can use this little PowerShell script which will show all VPNs in your VPCs along with the number and type of routes (BGP or static) for each VPN. See the output in the screen shot nearby, which I am thrilled to say was generated in PowerShell running on macOS using the AWSPowerShell.NetCore cmdlets. And, BTW, the script is actually just one (longish) statement that demonstrates how the power of the pipeline combines so masterfully with the AWS API.

Hope you enjoy this and, as always, I look forward to your feedback.

<#Copyright 2017 Air11 Technology LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
See the License for the specific language governing permissions and
limitations under the License. #>

Get-EC2VpnConnection | Select-Object -Property VpnConnectionId, VgwTelemetry | ` # Pass all objects to the pipeline
ForEach-Object -Process {
    $connectionID = $_.VpnConnectionId # get connection ID
    $_.VgwTelemetry | ForEach-Object {
        # There are multiple Amazon.Model.EC2.VgwTelemetry objects in each Amazon.Model.EC2.VPNConnection
        if (($_.status).value -ne 'UP')
            Write-Host "Connection $connectionID is $(($_.status).value) and has a status message of $(($_.StatusMessage))"
            # Uncomment the next statement and change the arn to send a message to an SNS topic
            # Publish-SNSMessage -TopicArn arn:aws:sns:us-east-1:01234567890:your-SNS-topic -Subject "VPN Status Alert!" -Message "The $ConnectionID is showing it's ($_.status).value"
            Write-Host "Connection $connectionID is $(($_.status).value) and has a status message of $(($_.StatusMessage))"




, , ,




2 responses to “Monitor the status of an AWS VPC VPN tunnel”

  1. Dan Avatar

    Thanks for this!  This is exactly what I’ve been looking for as a base for a VPN tunnel monitoring solution.  After being directed to this post, I’ve referenced it as an answer on ServerFault.

    1. Alex Neihaus Avatar
      Alex Neihaus

      Thank you, Dan.

      This is why I do write these posts: to try pay it forward a little for all the help I’ve gotten from people all over the world who post (for free) their ideas, techniques and code.

      I appreciate you providing an inbound link, too.


Leave a Reply

Your email address will not be published. Required fields are marked *