Both VPN tunnels for an AWS Site-to-Site VPN connection should be up

How to fix it

Get both tunnels reporting UP. This is almost never an AWS-side setting: the tunnel is down because the far end is not answering. Check the customer gateway is up and on the same public IP, that nothing drops UDP 500, UDP 4500 or ESP, that the pre-shared key matches, and that the phase proposals still overlap; AWS gives its own reason in each tunnel's status message. A tunnel whose startup action is not set to start only comes up when traffic starts it, so an idle one can sit DOWN with nothing wrong.

In the console

VPC → Site-to-Site VPN connections → the connection → Tunnel details