EC2 Client VPN endpoints should have client connection logging enabled

How to fix it

Turn on client connection logging for the endpoint and point it at a CloudWatch log group. Create the log group first, because the endpoint will not accept a name that does not exist; the log stream is optional. The change takes effect for new connections and disconnects nobody. These are connection events, not traffic: what a connected client then does inside the VPC is recorded by VPC flow logs, which is EC2.6.

In the console

VPC → Client VPN endpoints → the endpoint → Actions → Modify Client VPN endpoint → Connection logging

With the AWS CLI

aws ec2 modify-client-vpn-endpoint --client-vpn-endpoint-id <client-vpn-endpoint-id> --connection-log-options Enabled=true,CloudwatchLogGroup=<log-group-name> --region <region>

With Terraform

resource "aws_ec2_client_vpn_endpoint" "this" {
  client_cidr_block      = var.client_cidr_block
  server_certificate_arn = var.server_certificate_arn
  authentication_options {
    type                       = "certificate-authentication"
    root_certificate_chain_arn = var.client_certificate_arn
  }
  connection_log_options {
    enabled              = true
    cloudwatch_log_group = var.log_group_name
  }
}