We are currently running AWS Lambda functions within a VPC and for example already have a peering connection setup to MongoDB Atlas to have our AWS Lambda's within the VPC communicate to our MongoDB Atlas-hosted database.
Now a requirement has come up that a specific service within our VPC that we trigger by an AWS Lambda and that also runs within the same VPC has to access an on-premise network function / host over VPN. Furthermore that network needs to be able to respond to messages to that service so a site-to-site connection is needed I assume.
The customer has given us the IKE Phase One Parameters, IKE Phase Two Parameters (IPSEC), their local peer IP addresses, the VPN communication ports accepted and the local encryption domains.
They are now asking for our remote peer IP addresses and remote encryption domains.
Question 1: Is what we're trying to achieve feasible on AWS in a VPC (I'm reading conflicting posts about this.
Question 2: Am I correct in assuming that the tunnel initiating will have to happen from the customer's side and that we then use network monitoring polling to keep the tunnel active?