cloud services are great when they work. but in case something isn't you have no way to debug anything except maybe restarting the service if it's even possible

cloud services are great when they work. but in case something isn't you have no way to debug anything except maybe restarting the service if it's even possible. we had one customer that needed IPsec tunel to vpc where production servers were living, we didn't want to maintain such setup just for single customer so we check Aws offerings. and look at that they have managed IPsec solution, great. until client called that tunel is down and solution wa that they need to restart it on their end to resume connection. why? you can enable some logging to S3 but according to them everything should work. what we should do next? but even if you stick to just ec2 thing can go weird. our recent incident: ec2 instance stopped responding but ASG didn't replace it, any action on it throwers error that instance is not running but it was in running state.