CloudWiki
Resource

VPN Customer Gateway

Amazon Web Services
Network
A customer gateway is a resource that you create in your VPC that represents the customer gateway device in your on-premises network for working with Site-to-Site VPN connection.
Terraform Name
terraform
aws_customer_gateway
VPN Customer Gateway
attributes:
  • bgp_asn - (Required) The gateway's Border Gateway Protocol (BGP) Autonomous System Number (ASN).
  • certificate_arn - (Optional) The Amazon Resource Name (ARN) for the customer gateway certificate.
  • device_name - (Optional) A name for the customer gateway device.
  • ip_address - (Required) The IPv4 address for the customer gateway device's outside interface.
  • type - (Required) The type of customer gateway. The only type AWS supports at this time is "ipsec.1".
  • tags - (Optional) Tags to apply to the gateway. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

Associating resources with a
VPN Customer Gateway
Resources do not "belong" to a
VPN Customer Gateway
Rather, one or more Security Groups are associated to a resource.
Create
VPN Customer Gateway
via Terraform:
The following HCL creates a customer gateway with the specified IP address for its outside interface.
Syntax:

resource "aws_customer_gateway" "main" {
 bgp_asn    = 65000
 ip_address = "172.83.124.10"
 type       = "ipsec.1"

 tags = {
   Name = "main-customer-gateway"
 }
}

Create
VPN Customer Gateway
via CLI:
Parameters:

create-customer-gateway
--bgp-asn <value>
[--public-ip <value>]
[--certificate-arn <value>]
--type <value>
[--tag-specifications <value>]
[--device-name <value>]
[--ip-address <value>]
[--dry-run | --no-dry-run]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]

Example:

aws ec2 create-customer-gateway --type ipsec.1 --public-ip 12.1.2.3 --bgp-asn 65534

aws cost
Costs
There is no additional cost to use the VPN Customer Gateway as it is a required component of an VPN connection. However, the customer is responsible for providing and maintaining the customer gateway device or software, and for any costs associated with it such as hardware costs, software license fees, and internet connectivity costs.
Direct Cost

--

Indirect Cost
No items found.
Best Practices for
VPN Customer Gateway

Categorized by Availability, Security & Compliance and Cost

Low
Access allowed from VPN
No items found.
Low
Auto Scaling Group not in use
No items found.
Medium
Connections towards DynamoDB should be via VPC endpoints
No items found.
Medium
Container in CrashLoopBackOff state
No items found.
Low
EC2 with GPU capabilities
No items found.
Medium
EC2 with high privileged policies
No items found.
Medium
ECS cluster delete alarm
No items found.
Critical
ECS task with Admin access (*:*)
Medium
ECS task with high privileged policies
No items found.
Critical
EKS cluster delete alarm
No items found.
Medium
ElastiCache cluster delete alarm
No items found.
Medium
Ensure Container liveness probe is configured
No items found.
Medium
Ensure ECS task definition has memory limit
No items found.
Critical
Ensure EMR cluster master nodes are not publicly accessible
No items found.
More from
Amazon Web Services