Terraform (AWS) create VPN IPSec connection with non-default parameters - amazon-web-services

Question

I'm using Terraform to spin-up my infrastructure on AWS and keep state in the .tfstate file. In my application I have to VPN into other networks where the admin of the other network has defined parameters on the IPSec ESP connection that the VPN connection on my end has to adhere to.
Using Terraform I create a VPN Gateway and a Customer Gateway with the remote network's parameters to the extent that's possible. Then I create a VPN connection and the appropriate route. Here's my VPN code in Terraform:
resource "aws_vpn_gateway" "vpn_gw" {
vpc_id = "${aws_vpc.default.id}"
tags {
Name = "default"
Terraform = true
}
}
resource "aws_customer_gateway" "customer_gw" {
bgp_asn = 65000
ip_address = "172.0.0.1"
type = "ipsec.1"
}
resource "aws_vpn_connection" "default" {
vpn_gateway_id = "${aws_vpn_gateway.vpn_gw.id}"
customer_gateway_id = "${aws_customer_gateway.customer_gw.id}"
type = "ipsec.1"
static_routes_only = true
}
resource "aws_vpn_connection_route" "office" {
destination_cidr_block = "192.168.10.0/24"
vpn_connection_id = "${aws_vpn_connection.default.id}"
}
I have to be able to set the following parameters on my VPN tunnel for phase 1 and phase 2 of the connection:
Phase 1
Authentication Method e.g. Pre-shared Secret
Encryption Scheme e.g. IKE
Diffie-Hellman Group e.g. Group 2
Encryption Algorithm e.g. AES-256
Hashing Algorithm e.g. SHA-1
Main or Aggressive Mode e.g. Main Mode
Lifetime (for renegotiation) e.g. 86400
Phase 2
Encapsulation (ESP or AH) e.g. ESP
Encryption Algorithm e.g. AES-256
Authentication Algorithm e.g. SHA-1
Perfect Forward Secrecy e.g. NO-PFS
Lifetime (for renegotiation) e.g. 3600
The docs on the VPN Customer Gateway show that you can't set that many parameters yourself: https://www.terraform.io/docs/providers/aws/r/customer_gateway.html
The Boto API also doesn't allow any additional parameters to be set.
Is there any way of setting these parameters (programmatically)?

Answer 1

Unfortunately, the answer to your question is no. This isn't a Terraform issue, as such, this is a limitation of the service provided by AWS. You don't get that level of configuration with AWS's basic solution.
To achieve what you are looking for, you'll need to spin up an EC2 instance and either
Roll your own using OpenSwan, VyOS, etc., e.g., https://aws.amazon.com/marketplace/pp/B00JK5UPF6 (just the AWS costs)
Use a VPN appliance from the AWS marketplace, e.g., https://aws.amazon.com/marketplace/pp/B00OCG4OAA (you'll need to pay a licensing fee to the vendor, as well as your AWS costs)