EC2 VPN connections should have logging enabled

How to fix it

Turn on CloudWatch logging for both of the connection's tunnels. It is a per-tunnel setting and this passes only when every tunnel has it, so a connection logging one and not the other keeps failing. Each tunnel is changed separately, addressed by its own outside IP address, and AWS warns that modifying a tunnel interrupts traffic over it for up to several minutes, so change one at a time. EC2.183 changes the same tunnels, so set both at once.

In the console

VPC → Site-to-Site VPN connections → the connection → Actions → Modify VPN tunnel options → Tunnel activity log

With the AWS CLI

aws ec2 modify-vpn-tunnel-options --vpn-connection-id <vpn-connection-id> --vpn-tunnel-outside-ip-address <tunnel-outside-ip> --tunnel-options '{"LogOptions":{"CloudWatchLogOptions":{"LogEnabled":true,"LogGroupArn":"<log-group-arn>"}}}' --region <region>

With Terraform

resource "aws_vpn_connection" "this" {
  customer_gateway_id = var.customer_gateway_id
  transit_gateway_id  = var.transit_gateway_id
  type                = "ipsec.1"
  tunnel1_log_options {
    cloudwatch_log_options {
      log_enabled   = true
      log_group_arn = var.log_group_arn
    }
  }
  tunnel2_log_options {
    cloudwatch_log_options {
      log_enabled   = true
      log_group_arn = var.log_group_arn
    }
  }
}