Secure Site-to-Site VPN connections

None of these controls add meaningful AWS spend. VPN pricing is per-connection-hour and per-GB regardless of IKE version; CloudWatch Logs for sparse VPN and connection events typically cost single-digit dollars a month across an entire fleet, held flat with a retention policy. There is nothing to fund, which is exactly the category that slips through cost-led governance. The cost lives in inaction, and it is asymmetric.

Each check maps to a different flavour of risk. A downed redundant tunnel is a continuity risk: the connection still works on the survivor, so nothing looks wrong, until routine AWS maintenance on the surviving tunnel takes the whole link down during business hours, cutting off hybrid databases, authentication or internal APIs. The right way to value an open tunnel-state finding is the cost-per-hour of the systems on that link being unreachable, not any AWS charge. A deprecated IKEv1 tunnel is more likely to drop on an ISP failover (it lacks the path-mobility IKEv2 has), so it carries an engineering-hours cost on top of the audit exposure.

The audit dimension is the common thread. PCI DSS, ISO 27001 and HIPAA all require logs for systems carrying sensitive cross-network traffic, and deprecated crypto on an encrypted link is a finding any assessor will write up. An open finding in a regulated account is a liability with a carrying cost that accrues each audit cycle until it is closed, against a fix that is one configuration change at near-zero marginal cost.

Priya is the finance and risk partner for the network platform team. Security Hub surfaces a cluster of VPN findings: one Site-to-Site connection with a tunnel DOWN for three weeks, two connections still accepting IKEv1, and a batch with tunnel logging off. Her first instinct is not to ask what the fixes cost, because she already knows the answer is essentially nothing. VPN pricing is per-connection-hour and per-GB regardless of IKE version, and CloudWatch Logs for sparse VPN events run single-digit dollars a month across the whole fleet. There is nothing to fund, which is exactly the category that slips through cost-led governance, so the cost lives in inaction and it is asymmetric.

She reads each finding by the exposure it removes rather than by the finding count. The downed-tunnel finding is the one she ranks highest, because the connection still carries all its traffic on the survivor so nothing looks wrong, yet it has gone from two-of-two to one-of-one with no failover path; the right way to value it is the cost-per-hour of the hybrid databases, authentication and internal APIs on that link being unreachable when routine AWS maintenance takes the surviving tunnel down. The IKEv1 findings she values as the engineering-hours of tunnel flaps on ISP failovers plus the audit-cycle cost of carrying an open crypto finding in a regulated account. Her output for the risk pack is a worklist ordered by exposure, with a note that any tunnel left on IKEv1, unlogged or single-tunnel after the remediation window needs a recorded, time-bounded exception with a named owner, not a silent suppression.

This is a continuity, crypto-hygiene and audit-evidence capability, not a cost-savings one. Fixing it does not lower the invoice, so the right way to value it is by the exposure it removes. A downed-tunnel finding is worth the cost-per-hour of the systems on that link being unreachable multiplied by the likely outage duration, a number that dwarfs the ten-minute config change to restore and harden the tunnel. An IKEv1 finding is worth the engineering-hours of the tunnel flaps it causes on ISP failovers plus the audit-cycle cost of carrying an open finding in a regulated account.

The asymmetry is the whole argument: the cost to remediate is trivial, the cost of inaction is a low-probability-per-day, high-impact event plus a compounding compliance liability. The finance role is to make that asymmetry visible so a cheap fix to a live risk does not lose the priority contest to features, to track open findings in regulated accounts as liabilities with a carrying cost, and to require a recorded, time-bounded exception with a named owner for any tunnel left on IKEv1, unlogged, or single-tunnel after the remediation window.

Site-to-Site and Client VPNs are the encrypted bridges between AWS and our offices, data centers, partners and remote staff. These findings ask three things of them: are they using current cryptography, is the redundancy we paid for actually there, and can we explain what they did if something goes wrong? The report shows four separate flags, but it is one governance question.

The leadership concern is not the dollar amount, because there barely is one. It is that a working connection can be hiding a degraded backup tunnel, a deprecated protocol an auditor will flag, or a remote-access door with no log of who walked through it, and the organisation often finds out from a compliance scan rather than from the team that owns the link.

The durable answer is policy plus enforcement: IKEv2 only, both tunnels monitored so a drop pages a human in minutes, and logging on by default, all backed by guardrails so new VPNs cannot be created insecure. The fixes are cheap; the exposure they remove, unplanned downtime and missing audit evidence, is not.

After a Site-to-Site VPN to the on-prem order-management system went dark for forty minutes during announced AWS maintenance, the CTO asked the network team one question: why did routine, scheduled maintenance become our outage. The answer was that one of the two tunnels had been DOWN for ninety-one days after a firewall change at the data center, the surviving tunnel had quietly carried all the traffic, and no alarm had ever been wired to tunnel state, so the redundancy the business paid for had silently degraded to one-of-one with nobody watching.

The team stopped treating the encrypted links as set-and-forget and made VPN health a default. Every tunnel is now locked to IKEv2 only, both tunnels are monitored with a CloudWatch alarm on the AWS/VPN TunnelState metric wired to network on-call so the next drop pages a human in minutes rather than waiting for a quarterly scan, and connection and tunnel logging are on by default. The standard is pinned in the infrastructure-as-code modules and backed by Service Control Policies that deny tunnel options containing ikev1 and block new VPNs created without logging, so a new connection cannot be born insecure. Each critical link now has a named owner. The next maintenance window was a non-event, because failover actually had somewhere to go. That standing posture, detected and owned by policy rather than discovered in a scan, is the governance signal.

The reason this is tracked is not its cost, which is negligible. It is that a working VPN can quietly be a live unplanned-downtime risk, a deprecated-crypto liability, or a remote-access door with no audit trail, all hidden behind the fact that the service still works. The next routine failure, ISP event, or audit is what surfaces it.

There is a maturity signal underneath each finding. That a periodic compliance scan, rather than the team's own monitoring, surfaced a tunnel dead for weeks or a deprecated protocol nobody decided to allow tells you the network layer is not being watched and owned the way critical infrastructure should be. The leadership move is to set the standard, IKEv2 only, both tunnels monitored, logging on by default, enforce it with guardrails, and assign a named owner to each critical link, so the posture maintains itself.