AWS Site-to-Site VPN

Collect AWS Site-to-Site VPN connection assets, tunnel state, and traffic metrics.

Configuration¶

Install Func¶

We recommend enabling Hosted Func under Guance Integrations - Extensions. All prerequisites are installed automatically; continue with script installation.

For a self-hosted Func deployment, see Self-host Func.

Activate Script¶

Note: Prepare an AWS AK that meets the requirements. For simplicity, you can grant the global read-only permission ReadOnlyAccess directly.

Activate the script in Hosted Func¶

1. Log in to the Guance console
2. Click the 【Integration】 menu and select 【Cloud Account Management】
3. Click 【Add Cloud Account】, select 【AWS】, and fill in the required information on the interface. If you have already configured the cloud account information before, ignore this step
4. Click 【Test】, and if the test is successful, click 【Save】. If the test fails, please check if the relevant configuration information is correct and test again
5. Click 【Cloud Account Management】, and you can see the added cloud account in the list. Click the corresponding cloud account to enter the details page
6. Click [Integrations] on the cloud account details page. Find AWS Site-to-Site VPN in the Not installed list and click [Install] to open the installation dialog. Select the VPN region in use and install.

Activate the script manually¶

1. Sign in to the Func console, click [Script Market], open the Guance script market, and search for integration_aws_vpn.
2. Click 【Install】 and enter AWS AK ID, AK Secret, and the account name.
3. Click [Deploy Startup Script]. The system automatically creates the Startup script set and configures the corresponding startup script. Set regions to the VPN regions in use, separated by ASCII commas, and set cloudwatch_configs['targets'][0]['metrics'] to ['TunnelDataIn', 'TunnelDataOut', 'TunnelState'].
4. after enabling it, open"Management / Automatic Trigger Configuration"to view the automatic trigger configuration.Click[Run],to run it immediately,without waiting for the scheduled interval.wait a moment,you can view execution records and related logs

Verification¶

1. In"Management / Automatic Trigger Configuration"confirm that the automatic trigger configuration exists for the task,and review task records and logs for exceptions
2. In Guance, check that aws_vpn_connection asset information exists under [Infrastructure / Custom].
3. In Guance, check the aws_vpn measurement under [Metrics] for the monitoring data.

Metrics¶

After configuring AWS cloud monitoring, the default metrics are listed below. You can configure additional metrics for collection.AWS cloud monitoring metric details

AWS Site-to-Site VPN metrics are in the aws_vpn measurement.

tunnel_ip_address appears only in tunnel-level metrics; connection-level metrics are distinguished by vpn_id.