title: Terraform (AWS) create VPN IPSec connection with non-default parameters
body: <p>I'm using Terraform to spin-up my infrastructure on AWS and keep state in the .tfstate file. In my application I have to VPN into other networks where the admin of the other network has defined parameters on the IPSec ESP connection that the VPN connection on my end has to adhere to.</p>
  
  <p>Using Terraform I create a VPN Gateway and a Customer Gateway with the remote network's parameters to the extent that's possible. Then I create a VPN connection and the appropriate route. Here's my VPN code in Terraform:</p>
  
  <pre><code>resource "aws_vpn_gateway" "vpn_gw" {
      vpc_id = "${aws_vpc.default.id}"
  
      tags {
          Name = "default"
          Terraform = true
      }
  }
  
  resource "aws_customer_gateway" "customer_gw" {
      bgp_asn = 65000
      ip_address = "172.0.0.1"
      type = "ipsec.1"
  }
  
  resource "aws_vpn_connection" "default" {
      vpn_gateway_id = "${aws_vpn_gateway.vpn_gw.id}"
      customer_gateway_id = "${aws_customer_gateway.customer_gw.id}"
      type = "ipsec.1"
      static_routes_only = true
  }
  
  resource "aws_vpn_connection_route" "office" {
      destination_cidr_block = "192.168.10.0/24"
      vpn_connection_id = "${aws_vpn_connection.default.id}"
  }
  </code></pre>
  
  <p>I have to be able to set the following parameters on my VPN tunnel for phase 1 and phase 2 of the connection:</p>
  
  <p>Phase 1</p>
  
  <ul>
  <li><strong>Authentication Method</strong> e.g. Pre-shared Secret</li>
  <li><strong>Encryption Scheme</strong> e.g. IKE</li>
  <li><strong>Diffie-Hellman Group</strong> e.g. Group 2</li>
  <li><strong>Encryption Algorithm</strong> e.g. AES-256</li>
  <li><strong>Hashing Algorithm</strong> e.g. SHA-1</li>
  <li><strong>Main or Aggressive Mode</strong> e.g. Main Mode</li>
  <li><strong>Lifetime (for renegotiation)</strong> e.g. 86400</li>
  </ul>
  
  <p>Phase 2</p>
  
  <ul>
  <li><strong>Encapsulation (ESP or AH)</strong> e.g. ESP</li>
  <li><strong>Encryption Algorithm</strong> e.g. AES-256</li>
  <li><strong>Authentication Algorithm</strong> e.g. SHA-1</li>
  <li><strong>Perfect Forward Secrecy</strong> e.g. NO-PFS</li>
  <li><strong>Lifetime (for renegotiation)</strong> e.g. 3600</li>
  </ul>
  
  <p>The docs on the VPN Customer Gateway show that you can't set that many parameters yourself: <a href="https://www.terraform.io/docs/providers/aws/r/customer_gateway.html" rel="nofollow noreferrer">https://www.terraform.io/docs/providers/aws/r/customer_gateway.html</a>
  The Boto API also doesn't allow any additional parameters to be set.</p>
  
  <p>Is there any way of setting these parameters (programmatically)?</p>