How do I calculate throughput and set a CloudWatch alarm for Site-to-Site VPN?

Short description

Each tunnel in an AWS Site-to-Site VPN connection supports a maximum throughput of up to 1.25 Gbps. Use CloudWatch metrics to calculate throughput for an AWS Site-to-Site VPN connection. To create an alert for when throughput exceeds your specified values, create a CloudWatch alarm with an Amazon Simple Notification Service (Amazon SNS) notification.

Important: Throughput calculation is approximate and doesn't provide exact bandwidth usage up to the moment. A CloudWatch metrics alarm is effective for connections that exceed throughput for a duration of 15 minutes or more.

Resolution

1. Access the CloudWatch console, and choose the AWS Region that's associated with your virtual private network (VPN).
2. In the navigation pane, choose Metrics. Then, choose All metrics.
3. Under All Metrics, choose VPN. Then, choose VPN Tunnel Metrics.
4. Choose the TunnelDataIn and TunnelDataOut metrics for the VPN tunnel that you want to measure.
5. Choose the Graphed metrics tab, and then set the following parameters:
   Statistics: SUM
   Period: 5 minutes
6. Choose Add Math. From the dropdown list, choose Start with an empty expression.
7. After you choose Start with an empty expression, you see a math expression box. In this box, enter (m1+m2)*8/300.
   This formula converts bytes per second (Bps) to bits per second (bps) to calculate the output. The variables represent the following values:
   m1 = TunnelDataIn (in bytes)
   m2 = TunnelDataOut (in bytes)
8. Choose Apply.
9. In the graphed metrics section, you see the expression that you added and the metrics in the expression. To see the representation in the graph section, select only the expression you added: (m1+m2)*8/300. The output result is in bits per second.
   Note: Make sure to clear m1 and m2 so that you select only the math expression.
10. Configure your CloudWatch alarm for VPN connections. When you create the alarm, set the following values:
    For Select metric, enter the expression that you created in step 7. Select only this expression.
    In the Conditions section, set throughput value you want to monitor as a condition. For example, to get a notification when throughput reaches 100 Mbps, enter Greater/Equal(>=) 1,000,000,00.
    In the Additional configuration section, set Datapoints to alarm to 3 out of 3.
11. (Optional) Set up Amazon SNS notifications for the CloudWatch alarm.

Related information

VPN tunnel metrics and dimensions