Ensure that your AWS VPNs have both tunnels always active as a failover strategy in case of an outage or a planned maintenance.
This rule can help you with the following compliance standards:
This rule can help you work with the AWS Well-Architected Framework
This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS
Using two active tunnels for your AWS VPN (IPsec) connections will ensure redundancy when one of the tunnels becomes unavailable. A common scenario where a redundant configuration is useful is when a maintenance session is required and you need to keep the traffic flowing between the on-premise network and AWS VPC without any downtime.
To determine if your AWS VPN configuration has two active tunnels, perform the following:
To create and configure the second VPN IPSec tunnel for the on-premise network customer gateway, perform the following (depending on your customer gateway device some configuration settings might look different within your dashboard):