How to Get Notified When an AWS Site-to-Site VPN Tunnel Goes Down?

SOA-C03 By islever Editorial Last updated Oct 20, 2026

Implement metrics, alarms, and filters by using AWS monitoring and logging services.

Short answer

AC Create CloudWatch Logs metric filters for VPN tunnel metrics, then alarm on tunnel state with an SNS notification when the tunnel is unavailable.

Question

A company has created an AWS Site-to-Site VPN connection with logging enabled between the company's VPC and an on-premises data center. The company's finance team has begun to experience intermittent connectivity issues when the team tries to access an application that runs in the VPC from the data center.
The company needs to implement an automated monitoring solution to receive immediate notifications when a VPN tunnel becomes unavailable.
Which combination of steps will meet this requirement? (Choose two.)

Use Amazon CloudWatch Logs to collect and store VPN collection logs. Convert the logs into readable metrics. Create a metric filter to filter the logs for VPN tunnel metrics. Correct Answer
Use AWS CloudTrail to collect VPN logs. Store the logs in an Amazon S3 bucket. Use Amazon Athena to query the data to find site-to-site VPN tunnel connection errors. Store the error files in a second S3 bucket.
Use VPN tunnel metrics to create an Amazon CloudWatch alarm. Use Amazon SNS to send a notification when a VPN tunnel state changes. Correct Answer
Use Amazon EventBridge rules to invoke an AWS Lambda function. Configure the Lambda function to use Amazon SNS to send a notification when a VPN tunnel connection error is detected.
Use AWS Systems Manager to manage the VPN tunnels and to monitor VPN tunnels for any connection errors.

Key Takeaways

The exam tests whether you recognize native CloudWatch Logs metric filters plus CloudWatch alarms with SNS as the immediate notification path for VPN tunnel state changes, rather than custom EventBridge/Lambda automation.

AWS Site-to-Site VPN tunnel availability is monitored by creating CloudWatch Logs metric filters from VPN logs and a CloudWatch alarm on tunnel state metrics that notifies through Amazon SNS. This page confirms the correct two-step combination is A and C, not EventBridge/Lambda or CloudTrail/Athena.

Common mistake: A common wrong choice is D, assuming EventBridge can directly detect VPN tunnel connection errors and invoke Lambda; EventBridge has no native tunnel-error event here, and that custom pipeline adds unnecessary complexity.

Expert Analysis

Why the Answer Is Correct

Options A and C form the native AWS monitoring path for a Site-to-Site VPN connection. Because VPN logging is already enabled, CloudWatch Logs can collect those logs and metric filters can extract tunnel-related metrics used for monitoring. Option C then creates a CloudWatch alarm on VPN tunnel metrics and uses Amazon SNS to send immediate notifications when the tunnel state changes to unavailable. AWS exposes Site-to-Site VPN tunnel state through CloudWatch metrics, so this combination is both automated and aligned with the requirement for immediate notification. The two steps are complementary: A supplies log-derived metric data, and C turns tunnel-state changes into an actionable alert.

Why the Other Options Are Wrong

Option B uses AWS CloudTrail and Amazon Athena, but CloudTrail records control-plane API activity rather than VPN tunnel availability, and Athena queries are not an immediate alerting mechanism. Option D uses EventBridge and Lambda, but it does not identify a native event source for VPN tunnel connection errors; building a custom detection pipeline is not the intended solution here. Option E incorrectly relies on AWS Systems Manager to manage and monitor VPN tunnels, which is not the service used for Site-to-Site VPN tunnel-state alarms. Only CloudWatch metrics and alarms provide the direct, managed notification path described in the question.

Community Comment Notes

Bad_Mat explicitly selected A and C and described the same CloudWatch Logs metric-filter plus CloudWatch alarm/SNS workflow. Bad_Mat summed it up: “The correct steps to implement this automated monitoring solution are A and C.” That matches the native AWS monitoring design for VPN tunnel state changes.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a scenario says VPN logging is enabled and asks for immediate notification, map it to CloudWatch Logs metric filters plus a CloudWatch alarm with an SNS action. Do not be lured by CloudTrail/Athena, which is for API audit queries, or EventBridge/Lambda, which needs a native event source.

Frequently Asked Questions

Why is EventBridge with Lambda not the best choice for VPN tunnel alerts?

Amazon EventBridge has no native Site-to-Site VPN tunnel-state event in this scenario; a CloudWatch alarm on tunnel state can directly trigger SNS instead.

Does CloudTrail capture Site-to-Site VPN tunnel availability?

No. CloudTrail records API activity such as CreateVpnConnection, not data-plane tunnel state; Athena queries over CloudTrail logs are not an immediate outage alert.

More SOA-C03 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

Bad_Mat 👍 1

The correct steps to implement this automated monitoring solution are A and C.A. Use Amazon CloudWatch Logs to collect and store VPN collection logs. Convert the logs into readable metrics. Create a metric filter to filter the logs for VPN tunnel metrics.C. Use VPN tunnel metrics to create an Amazon CloudWatch alarm. Use Amazon SNS to send a notification when a VPN tunnel state changes

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide