Enable connection logging for a new AWS Client VPN endpoint

You can enable connection logging when you create a new Client VPN endpoint by using the console or the command line.

To enable connection logging for a new Client VPN endpoint using the console

1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

2. In the navigation pane, choose Client VPN Endpoints, and then choose Create Client VPN endpoint.

3. Complete the options until you reach the Connection Logging section. For more information about the options, see Create an AWS Client VPN endpoint.

4. Under Connection logging, turn on Enable log details on client connections.

5. For CloudWatch Logs log group name, choose the name of the CloudWatch Logs log group.

6. (Optional) For CloudWatch Logs log stream name, choose the name of the CloudWatch Logs log stream.

7. Choose Create Client VPN endpoint.

To enable connection logging for a new Client VPN endpoint using the AWS CLI

Use the create-client-vpn-endpoint command, and specify the --connection-log-options parameter. You can specify the connection logs information in JSON format, as shown in the following example.

{
    "Enabled": true,
    "CloudwatchLogGroup": "ClientVpnConnectionLogs",
    "CloudwatchLogStream": "NewYorkOfficeVPN"
}