crypto keyring ENCC-AWS-KEY01
 pre-shared-key address <peer01-public-address> key <key-01>
!
crypto keyring ENCC-AWS-KEY02
 pre-shared-key address <peer02-public-address> key <key-02>
 
crypto ikev2 keyring AWS_S2S_VPN
 peer <peer01-public-address>_AWS01
  address <peer01-public-address>
   pre-shared-key local <key-01>
   pre-shared-key remote <key-01>
!
 peer <peer02-public-address>_AWS02
  address <peer02-public-address>
   pre-shared-key local <key-02>
   pre-shared-key remote <key-02>
   
crypto ikev2 fragmentation mtu 1200
!
crypto ipsec transform-set ENCC-IPSEC-VPN esp-gcm 256
 mode transport
!
crypto ikev2 proposal ENCC-AWS-IKE-PROPOSAL 
 encryption aes-gcm-256
 prf sha512
 group 20
!
crypto ikev2 policy ENCC-AWS-POLICY 
 proposal ENCC-AWS-IKE-PROPOSAL
!
crypto ikev2 profile ENCC-AWS-IKE-PROFILE
 match identity remote address <peer01-public-address> 255.255.255.255
 match identity remote address <peer02-public-address> 255.255.255.255
 identity local address <local-outside-ip-address>
 authentication local pre-share
 authentication remote pre-share
 keyring local AWS_S2S_VPN
 dpd 10 2 on-demand
!
!
crypto ipsec profile ENCC-AWS-IPSEC-PROFILE
 set transform-set ENCC-IPSEC-VPN
 set pfs group20
 set ikev2-profile ENCC-AWS-IKE-PROFILE
 

interface tunnel 1
 desc TO AWS1
 ip address <peer01-local-cidr> 255.255.255.252
 tunnel protection ipsec profile ENCC-AWS-IPSEC-PROFILE
 tunnel source <upstream-interface>
 tunnel mode ipsec ipv4
 tunnel destination <peer01-remote-cidr>
 ip mtu 1400
 ip tcp adjust-mss 1360
!
interface tunnel 2
 desc TO AWS2
 ip address <peer02-local-cidr> 255.255.255.252
 tunnel protection ipsec profile ENCC-AWS-IPSEC-PROFILE
 tunnel source <upstream-interface>
 tunnel mode ipsec ipv4
 tunnel destination <peer02-remote-cidr>
 ip mtu 1400
 ip tcp adjust-mss 1360
 
ip route <aws-vpc-subnet> <aws-vpc-subnet-mask> <peer01-public-address>
ip route <aws-vpc-subnet> <aws-vpc-subnet-mask> <peer02-public-address>