AWS Site to Site VPN log is not generating in Cloudwatch log group

Question

Help Post:

I am having a problem with the Site-to-site VPN tunnel not generating log to Cloud Watch Group. I have enabled the VPN tunnel log for both tunnels. First I got the log but after updating the tunnel option it is not generating any more

This is the error in the Cloudwatch log![Enter image description here](/media/postImages/original/IMKVFfOWPIQWeP0P7z8637jA)

Sivaraman Selvam · Answer

Hello,

For the logging feature to function correctly, the IAM policy attached to the IAM principal used to configure the feature must include the following permissions as a minimum requirement:
https://docs.aws.amazon.com/vpn/latest/s2svpn/monitoring-logs.html

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "logs:CreateLogDelivery",
        "logs:GetLogDelivery",
        "logs:UpdateLogDelivery",
        "logs:DeleteLogDelivery",
        "logs:ListLogDeliveries"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow",
      "Sid": "S2SVPNLogging"
    },
    {
      "Sid": "S2SVPNLoggingCWL",
      "Action": [
        "logs:PutResourcePolicy",
        "logs:DescribeResourcePolicies",
        "logs:DescribeLogGroups"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    }
  ]
}  
```

AWS Site to Site VPN log is not generating in Cloudwatch log group

Add your answer

Relevant content