AWS Client VPN Connection Logs

Self Service Ingestion

Connect this data source on your own, using the Hunters platform.

Overview

Table name: aws_client_vpn_logs

AWS Client VPN Connection Logs contain connection log entires. Each connection log entry contains information about a connection event, which is when a client (end user) connects, attempts to connect, or disconnects from your Client VPN endpoint. You can use this information to run forensics, analyze how your Client VPN endpoint is being used, or debug connection issues.

Send data to Hunters

In order to integrate with different systems and tools, Amazon AWS Client VPN exports connection logs to Amazon Cloudwatch as stated here.

To connect AWS Client VPN Connection Logs to Hunters:

  1. Follow these guidelines to ship the logs to a destination bucket.

  2. Once the export is completed and the logs are collected to S3, follow the steps in this section.

Expected format

Logs are expected in NDJSON format.

{"connection-log-type":"connection-attempt","connection-attempt-status":"successful","connection-reset-status":"NA","connection-attempt-failure-reason":"NA","connection-id":"cvpn-connection-abc123abc123abc12","client-vpn-endpoint-id":"cvpn-endpoint-aaa111bbb222ccc33","transport-protocol":"udp","connection-start-time":"2020-03-26 20:37:15","connection-last-update-time":"2020-03-26 20:37:15","client-ip":"10.0.1.2","common-name":"client1","device-type":"mac","device-ip":"98.247.202.82","port":"50096","ingress-bytes":"0","egress-bytes":"0","ingress-packets":"0","egress-packets":"0","connection-end-time":"NA","username":"joe"}"}