The vpn metricset of aws module allows users to monitor VPN tunnels.
VPN metric data is automatically sent to CloudWatch as it becomes available. Users
can use these metrics to gain a better perspective on how the web application or
service is performing.

[float]
=== AWS Permissions
Some specific AWS permissions are required for IAM user to collect usage metrics.
----
ec2:DescribeRegions
cloudwatch:GetMetricData
cloudwatch:ListMetrics
tag:getResources
sts:GetCallerIdentity
iam:ListAccountAliases
----

[float]
=== Dashboard

The aws vpn metricset comes with a predefined dashboard. For example:

image::./images/metricbeat-aws-vpn-overview.png[]

[float]
=== Configuration example
[source,yaml]
----
- module: aws
  period: 1m
  metricsets:
    - vpn
  # This module uses the aws cloudwatch metricset, all
  # the options for this metricset are also available here.
----

[float]
=== Metrics and Dimensions for VPN
Metrics:
|===
|Metric Name|Statistic Method | Description
|TunnelState | Max | The state of the tunnel. For static VPNs, 0 indicates DOWN and 1 indicates UP. For BGP VPNs, 1 indicates ESTABLISHED and 0 is used for all other states.
|TunnelDataIn| Sum | The bytes received through the VPN tunnel.
|TunnelDataOut| Sum | The bytes sent through the VPN tunnel.
|===

Dimensions:
|===
|Dimension Name| Description
|VpnId | Filters the metric data by the Site-to-Site VPN connection ID.
|TunnelIpAddress | Filters the metric data by the IP address of the tunnel for the virtual private gateway.
|===

Please see https://docs.aws.amazon.com/vpn/latest/s2svpn/monitoring-cloudwatch-vpn.html[VPN Tunnel CloudWatch Metrics] for more details.
