One tunnel of an AWS Site-to-Site VPN connection is down.
Detect the state change and notify the network operations team.
Which configuration is most appropriate?
Create a CloudWatch alarm for the VPN TunnelState metric and notify an SNS topic.
Detailed explanation
S3 capacity is unrelated to VPN tunnel availability.
S3 capacity is unrelated to VPN tunnel availability.
TunnelState exposes the tunnel status, and an alarm can publish a notification or trigger automation.
TunnelState exposes the tunnel status, and an alarm can publish a notification or trigger automation.
DNS cache duration does not indicate VPN tunnel state.
DNS cache duration does not indicate VPN tunnel state.
CDN latency does not directly identify a VPN tunnel failure.
CDN latency does not directly identify a VPN tunnel failure.
Check official documentation
Compare the following points with the official documentation.
AWS Site-to-Site VPN CloudWatch TunnelStateの公式説明を確認する。
What to confirm
ネットワークメトリクスとDNS・CDNメトリクスを区別できる。
Key points
- TunnelState
- CloudWatch alarm
- SNS
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Metric selection
A tunnel-state metric directly represents path availability, unlike storage or CDN metrics.
Alert path
CloudWatch detects the condition and SNS distributes the notification.