Skip to content
AWS for Query.Farm

aws.ec2.describe_vpn_connections

Example SQL Queries

SELECT * FROM
aws.ec2.describe_vpn_connections;

Description

Describes one or more of your VPN connections.

For more information, see Amazon Web Services Site-to-Site VPN in the Amazon Web Services Site-to-Site VPN User Guide.

Table Definition

Column NameColumn Data Type
dry_run Input Column

Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

BOOLEAN
filters Input Column

One or more filters.

  • customer-gateway-configuration - The configuration information for the customer gateway.

  • customer-gateway-id - The ID of a customer gateway associated with the VPN connection.

  • state - The state of the VPN connection (pending | available | deleting | deleted).

  • option.static-routes-only - Indicates whether the connection has static routes only. Used for devices that do not support Border Gateway Protocol (BGP).

  • route.destination-cidr-block - The destination CIDR block. This corresponds to the subnet used in a customer data center.

  • bgp-asn - The BGP Autonomous System Number (ASN) associated with a BGP device.

  • tag:<key> - The key/value combination of a tag assigned to the resource. Use the tag key in the filter name and the tag value as the filter value. For example, to find all resources that have a tag with the key Owner and the value TeamA, specify tag:Owner for the filter name and TeamA for the filter value.

  • tag-key - The key of a tag assigned to the resource. Use this filter to find all resources assigned a tag with a specific key, regardless of the tag value.

  • type - The type of VPN connection. Currently the only supported type is ipsec.1.

  • vpn-connection-id - The ID of the VPN connection.

  • vpn-gateway-id - The ID of a virtual private gateway associated with the VPN connection.

  • transit-gateway-id - The ID of a transit gateway associated with the VPN connection.

STRUCT(
    "name" VARCHAR,
    "values" VARCHAR[]
)[]
Show child fields
filters[]
Show child fields
filters[].name

The name of the filter. Filter names are case-sensitive.

filters[].values[]
vpn_connection_ids Input Column

One or more VPN connection IDs.

Default: Describes your VPN connections.

VARCHAR[]
Show child fields
vpn_connection_ids[]
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
vpn_connections

Information about one or more VPN connections.

STRUCT(
    "customer_gateway_configuration" VARCHAR,
    "customer_gateway_id" VARCHAR,
    "category" VARCHAR,
    "state" VARCHAR,
    "type" VARCHAR,
    "vpn_connection_id" VARCHAR,
    "vpn_gateway_id" VARCHAR,
    "transit_gateway_id" VARCHAR,
    "core_network_arn" VARCHAR,
    "core_network_attachment_arn" VARCHAR,
    "gateway_association_state" VARCHAR,
    "options" STRUCT(
        "enable_acceleration" BOOLEAN,
        "static_routes_only" BOOLEAN,
        "local_ipv4_network_cidr" VARCHAR,
        "remote_ipv4_network_cidr" VARCHAR,
        "local_ipv6_network_cidr" VARCHAR,
        "remote_ipv6_network_cidr" VARCHAR,
        "outside_ip_address_type" VARCHAR,
        "transport_transit_gateway_attachment_id" VARCHAR,
        "tunnel_inside_ip_version" VARCHAR,
        "tunnel_options" STRUCT(
            "outside_ip_address" VARCHAR,
            "tunnel_inside_cidr" VARCHAR,
            "tunnel_inside_ipv6_cidr" VARCHAR,
            "pre_shared_key" VARCHAR,
            "phase1_lifetime_seconds" BIGINT,
            "phase2_lifetime_seconds" BIGINT,
            "rekey_margin_time_seconds" BIGINT,
            "rekey_fuzz_percentage" BIGINT,
            "replay_window_size" BIGINT,
            "dpd_timeout_seconds" BIGINT,
            "dpd_timeout_action" VARCHAR,
            "phase1_encryption_algorithms" STRUCT(
                "value" VARCHAR
            )[],
            "phase2_encryption_algorithms" STRUCT(
                "value" VARCHAR
            )[],
            "phase1_integrity_algorithms" STRUCT(
                "value" VARCHAR
            )[],
            "phase2_integrity_algorithms" STRUCT(
                "value" VARCHAR
            )[],
            "phase1_dh_group_numbers" STRUCT(
                "value" BIGINT
            )[],
            "phase2_dh_group_numbers" STRUCT(
                "value" BIGINT
            )[],
            "ike_versions" STRUCT(
                "value" VARCHAR
            )[],
            "startup_action" VARCHAR,
            "log_options" STRUCT(
                "cloud_watch_log_options" STRUCT(
                    "log_enabled" BOOLEAN,
                    "log_group_arn" VARCHAR,
                    "log_output_format" VARCHAR
                )
            ),
            "enable_tunnel_lifecycle_control" BOOLEAN
        )[]
    ),
    "routes" STRUCT(
        "destination_cidr_block" VARCHAR,
        "source" VARCHAR,
        "state" VARCHAR
    )[],
    "tags" STRUCT(
        "key" VARCHAR,
        "value" VARCHAR
    )[],
    "vgw_telemetry" STRUCT(
        "accepted_route_count" BIGINT,
        "last_status_change" TIMESTAMP_S,
        "outside_ip_address" VARCHAR,
        "status" VARCHAR,
        "status_message" VARCHAR,
        "certificate_arn" VARCHAR
    )[]
)[]
Show child fields
vpn_connections[]
Show child fields
vpn_connections[].category

The category of the VPN connection. A value of VPN indicates an Amazon Web Services VPN connection. A value of VPN-Classic indicates an Amazon Web Services Classic VPN connection.

vpn_connections[].core_network_arn

The ARN of the core network.

vpn_connections[].core_network_attachment_arn

The ARN of the core network attachment.

vpn_connections[].customer_gateway_configuration

The configuration information for the VPN connection's customer gateway (in the native XML format). This element is always present in the CreateVpnConnection response; however, it's present in the DescribeVpnConnections response only if the VPN connection is in the pending or available state.

vpn_connections[].customer_gateway_id

The ID of the customer gateway at your end of the VPN connection.

vpn_connections[].gateway_association_state

The current state of the gateway association.

vpn_connections[].options

The VPN connection options.

Show child fields
vpn_connections[].options.enable_acceleration

Indicates whether acceleration is enabled for the VPN connection.

vpn_connections[].options.local_ipv4_network_cidr

The IPv4 CIDR on the customer gateway (on-premises) side of the VPN connection.

vpn_connections[].options.local_ipv6_network_cidr

The IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection.

vpn_connections[].options.outside_ip_address_type

The type of IPv4 address assigned to the outside interface of the customer gateway.

Valid values: PrivateIpv4 | PublicIpv4

Default: PublicIpv4

vpn_connections[].options.remote_ipv4_network_cidr

The IPv4 CIDR on the Amazon Web Services side of the VPN connection.

vpn_connections[].options.remote_ipv6_network_cidr

The IPv6 CIDR on the Amazon Web Services side of the VPN connection.

vpn_connections[].options.static_routes_only

Indicates whether the VPN connection uses static routes only. Static routes must be used for devices that don't support BGP.

vpn_connections[].options.transport_transit_gateway_attachment_id

The transit gateway attachment ID in use for the VPN tunnel.

vpn_connections[].options.tunnel_inside_ip_version

Indicates whether the VPN tunnels process IPv4 or IPv6 traffic.

vpn_connections[].options.tunnel_options[]
Show child fields
vpn_connections[].options.tunnel_options[].dpd_timeout_action

The action to take after a DPD timeout occurs.

vpn_connections[].options.tunnel_options[].dpd_timeout_seconds

The number of seconds after which a DPD timeout occurs.

vpn_connections[].options.tunnel_options[].enable_tunnel_lifecycle_control

Status of tunnel endpoint lifecycle control feature.

vpn_connections[].options.tunnel_options[].ike_versions[]
Show child fields
vpn_connections[].options.tunnel_options[].ike_versions[].value

The IKE version.

vpn_connections[].options.tunnel_options[].log_options

Options for logging VPN tunnel activity.

Show child fields
vpn_connections[].options.tunnel_options[].log_options.cloud_watch_log_options

Options for sending VPN tunnel logs to CloudWatch.

Show child fields
vpn_connections[].options.tunnel_options[].log_options.cloud_watch_log_options.log_enabled

Status of VPN tunnel logging feature. Default value is False.

Valid values: True | False

vpn_connections[].options.tunnel_options[].log_options.cloud_watch_log_options.log_group_arn

The Amazon Resource Name (ARN) of the CloudWatch log group to send logs to.

vpn_connections[].options.tunnel_options[].log_options.cloud_watch_log_options.log_output_format

Configured log format. Default format is json.

Valid values: json | text

vpn_connections[].options.tunnel_options[].outside_ip_address

The external IP address of the VPN tunnel.

vpn_connections[].options.tunnel_options[].phase1_dh_group_numbers[]
Show child fields
vpn_connections[].options.tunnel_options[].phase1_dh_group_numbers[].value

The Diffie-Hellmann group number.

vpn_connections[].options.tunnel_options[].phase1_encryption_algorithms[]
Show child fields
vpn_connections[].options.tunnel_options[].phase1_encryption_algorithms[].value

The value for the encryption algorithm.

vpn_connections[].options.tunnel_options[].phase1_integrity_algorithms[]
Show child fields
vpn_connections[].options.tunnel_options[].phase1_integrity_algorithms[].value

The value for the integrity algorithm.

vpn_connections[].options.tunnel_options[].phase1_lifetime_seconds

The lifetime for phase 1 of the IKE negotiation, in seconds.

vpn_connections[].options.tunnel_options[].phase2_dh_group_numbers[]
Show child fields
vpn_connections[].options.tunnel_options[].phase2_dh_group_numbers[].value

The Diffie-Hellmann group number.

vpn_connections[].options.tunnel_options[].phase2_encryption_algorithms[]
Show child fields
vpn_connections[].options.tunnel_options[].phase2_encryption_algorithms[].value

The encryption algorithm.

vpn_connections[].options.tunnel_options[].phase2_integrity_algorithms[]
Show child fields
vpn_connections[].options.tunnel_options[].phase2_integrity_algorithms[].value

The integrity algorithm.

vpn_connections[].options.tunnel_options[].phase2_lifetime_seconds

The lifetime for phase 2 of the IKE negotiation, in seconds.

vpn_connections[].options.tunnel_options[].pre_shared_key

The pre-shared key (PSK) to establish initial authentication between the virtual private gateway and the customer gateway.

vpn_connections[].options.tunnel_options[].rekey_fuzz_percentage

The percentage of the rekey window determined by RekeyMarginTimeSeconds during which the rekey time is randomly selected.

vpn_connections[].options.tunnel_options[].rekey_margin_time_seconds

The margin time, in seconds, before the phase 2 lifetime expires, during which the Amazon Web Services side of the VPN connection performs an IKE rekey.

vpn_connections[].options.tunnel_options[].replay_window_size

The number of packets in an IKE replay window.

vpn_connections[].options.tunnel_options[].startup_action

The action to take when the establishing the VPN tunnels for a VPN connection.

vpn_connections[].options.tunnel_options[].tunnel_inside_cidr

The range of inside IPv4 addresses for the tunnel.

vpn_connections[].options.tunnel_options[].tunnel_inside_ipv6_cidr

The range of inside IPv6 addresses for the tunnel.

vpn_connections[].routes[]
Show child fields
vpn_connections[].routes[].destination_cidr_block

The CIDR block associated with the local subnet of the customer data center.

vpn_connections[].routes[].source

Indicates how the routes were provided.

vpn_connections[].routes[].state

The current state of the static route.

vpn_connections[].state

The current state of the VPN connection.

vpn_connections[].tags[]
Show child fields
vpn_connections[].tags[].key

The key of the tag.

Constraints: Tag keys are case-sensitive and accept a maximum of 127 Unicode characters. May not begin with aws:.

vpn_connections[].tags[].value

The value of the tag.

Constraints: Tag values are case-sensitive and accept a maximum of 256 Unicode characters.

vpn_connections[].transit_gateway_id

The ID of the transit gateway associated with the VPN connection.

vpn_connections[].type

The type of VPN connection.

vpn_connections[].vgw_telemetry[]
Show child fields
vpn_connections[].vgw_telemetry[].accepted_route_count

The number of accepted routes.

vpn_connections[].vgw_telemetry[].certificate_arn

The Amazon Resource Name (ARN) of the VPN tunnel endpoint certificate.

vpn_connections[].vgw_telemetry[].last_status_change

The date and time of the last change in status. This field is updated when changes in IKE (Phase 1), IPSec (Phase 2), or BGP status are detected.

vpn_connections[].vgw_telemetry[].outside_ip_address

The Internet-routable IP address of the virtual private gateway's outside interface.

vpn_connections[].vgw_telemetry[].status

The status of the VPN tunnel.

vpn_connections[].vgw_telemetry[].status_message

If an error occurs, a description of the error.

vpn_connections[].vpn_connection_id

The ID of the VPN connection.

vpn_connections[].vpn_gateway_id

The ID of the virtual private gateway at the Amazon Web Services side of the VPN connection.