Establishing a Site-to-Site VPN between Scaleway and AWS

vpnipsecbgpawshybrid-cloud

Reviewed on February 16, 2026

This tutorial explains how to establish a dynamic Site-to-Site (S2S) VPN between Scaleway and AWS using the Scaleway Managed VPN Gateway.

The configuration uses:

Before you start

To complete the actions presented below, you must have:

The connection is established between:

Routes are dynamically exchanged between:

Create or select a VPC in the Scaleway console.
Create a Private Network within the VPC.
Deploy a Managed VPN Gateway attached to that Private Network.
Note the following information:
- The public IPv4 address of the Scaleway VPN Gateway (e.g., 163.172.175.212).
- The Scaleway ASN: 12876.

Create a Customer Gateway in the AWS console.
Configure the following parameters:
- Type: IPsec.
- IP address: The public IP of your Scaleway VPN Gateway.
- BGP ASN: 12876.

Create a Virtual Private Gateway and attach it to your AWS VPC.
Configure an ASN (e.g., 65000).

Note
The ASN configured here must match the ASN defined later in the Scaleway Customer Gateway configuration.

Create a new VPN Connection using the following settings:
- Routing Priority: Dynamic (requires BGP).
- Virtual Private Gateway: Select the gateway created above.
- Customer Gateway: Select the gateway created in the previous step.
After the connection is created, collect the following details:
- Tunnel public IP (e.g., 13.37.176.32).
- BGP peer private IP (e.g., 169.254.162.101).
- Download the Generic configuration file for reference.

In the Scaleway console, create a Customer Gateway using:

Define a routing policy in Scaleway to control traffic:

This ensures that only authorized routes are exchanged.

Attach the Scaleway VPN Gateway.
Attach the AWS Customer Gateway.
Enable Route propagation.
Select the Routing policy created in the previous step.
Configure the BGP settings:
- Provide a private IP within the AWS inside CIDR range.
- Provide the AWS BGP peer private IP.
Important
Both IP addresses must belong to the same /30 subnet provided by AWS in the configuration file.

Scaleway automatically generates a PSK and stores it in Secret Manager when the VPN connection is created.

Use the Scaleway CLI to find your secret:

scw secret secret list region=fr-par -o json | jq .

Retrieve the Base64-encoded secret value using the id from the previous step:
```
scw secret version access <SECRET_ID> revision=latest region=fr-par
```
Decode the value to obtain your cleartext PSK:
```
echo '<BASE64_PSK>' | base64 -d
```

Access your VPN Tunnel settings in the AWS Console and update the pre-shared key with the decoded value.

Both environments must use identical IPsec settings for the tunnel to establish.