AWS Certified Advanced Networking – Specialty (ANS-C01)Network Management and OperationsMedium
A financial services company has a strict requirement for network traffic to be encrypted in transit between their on-premises data center and AWS VPCs. They are using AWS Site-to-Site VPN connections. To ensure compliance and verify that all VPN traffic is indeed encrypted, they need a mechanism to monitor the encryption status and key exchange process of their VPN tunnels. Which AWS monitoring capability directly provides this information?
- AAWS CloudTrail for VPN API calls
- BAWS CloudWatch Metrics for VPN Tunnels
- CVPC Flow Logs for VPN traffic
- DDirect Connect Connection Monitoring
Show answer & explanationAnswer & explanation
Correct answer: B. AWS CloudWatch Metrics for VPN Tunnels
AWS CloudWatch provides specific metrics for Site-to-Site VPN tunnels, including 'TunnelState' which indicates if the tunnel is UP or DOWN, and 'TunnelDataIn/Out' for traffic. Crucially, the 'TunnelState' metric reflects the status of the IPsec tunnel, which implicitly confirms the successful establishment of the encrypted connection and key exchange. While it doesn't show the encryption keys themselves, a 'UP' state confirms encryption is active.
Why the other options are wrong
- A. AWS CloudTrail records API calls related to VPN creation or modification, but does not provide real-time operational status or encryption details of active tunnels.
- C. VPC Flow Logs capture IP traffic metadata (source/destination IP, port, protocol), but do not directly show the encryption status or key exchange details of the VPN tunnel.
- D. Direct Connect Connection Monitoring is for dedicated private connections, not for IPsec VPN tunnels, and is irrelevant to this scenario.
VPN Tunnel Metrics
Amazon CloudWatch provides detailed metrics for AWS Site-to-Site VPN tunnels, indicating their operational status and data transfer.
- Monitors TunnelState (UP/DOWN)
- Reports IPSecTunnelState
- Confirms active encrypted connection when UP
Memory trick: CloudWatch VPN Metrics: The dashboard that lights up when encryption is active.