crypto ikev2 keyring AWS_KEYS
 peer AWS_TUNNEL_1
  address 52.6.37.236
  pre-shared-key local T5U7GCljSzr05njYQuDgL3quzeoupF55
  pre-shared-key remote T5U7GCljSzr05njYQuDgL3quzeoupF55

 peer AWS_TUNNEL_2
  address 54.227.243.146
  pre-shared-key local T5U7GCljSzr05njYQuDgL3quzeoupF55
  pre-shared-key remote T5U7GCljSzr05njYQuDgL3quzeoupF55

crypto ikev2 fragmentation mtu 1200

crypto ikev2 proposal IKEV2_PROPOSAL_AWS
 encryption aes-gcm-256
 prf sha512
 group 20

crypto ikev2 policy IKEV2_POLICY_AWS
 proposal IKEV2_PROPOSAL_AWS
 match address local 204.186.19.10

crypto ikev2 profile IKEV2_PROFILE_AWS
 match address local 204.186.19.10
 match identity remote address 52.6.37.236 255.255.255.255
 match identity remote address 54.227.243.146 255.255.255.255
 identity local address 204.186.19.10
 authentication local pre-share
 authentication remote pre-share
 keyring local AWS_KEYS
 dpd 10 2 on-demand

crypto ipsec transform-set TS_AWS esp-gcm 256
 mode tunnel

crypto ipsec profile IPSEC_PROFILE_AWS
 set transform-set TS_AWS
 set pfs group20
 set ikev2-profile IKEV2_PROFILE_AWS

interface tunnel 1
 desc TO AWS1
 ip address 169.254.166.138 255.255.255.252
 tunnel protection ipsec profile IPSEC_PROFILE_AWS
 tunnel source gigabitethernet1
 tunnel mode ipsec ipv4
 tunnel destination 52.6.37.236
 ip mtu 1400
 ip tcp adjust-mss 1360

interface tunnel 2
 desc TO AWS2
 ip address 169.254.45.194 255.255.255.252
 tunnel protection ipsec profile IPSEC_PROFILE_AWS
 tunnel source gigabitethernet1
 tunnel mode ipsec ipv4
 tunnel destination 54.227.243.146
 ip mtu 1400
 ip tcp adjust-mss 1360