diff --git a/cloud/aws/vpn/README.md b/cloud/aws/vpn/README.md
index 21a545d..4876c79 100644
--- a/cloud/aws/vpn/README.md
+++ b/cloud/aws/vpn/README.md
@@ -26,8 +26,6 @@ Inputs
 |------|-------------|:----:|:-----:|:-----:|
 | environment | Architecture Environment | string | - | yes |
 | evaluation_delay | Delay in seconds for the metric evaluation | string | `600` | no |
+| filter_tags_custom | Tags used for custom filtering when filter_tags_use_defaults is false | string | `*` | no |
+| filter_tags_use_defaults | Use default filter tags convention | string | `true` | no |
 | message | Message sent when an alert is triggered | string | - | yes |
-| vpn_status_critical | Both tunnels are down | string | `0` | no |
-| vpn_status_ok | Both tunnels are up, everything is ok | string | `2` | no |
-| vpn_status_warning | Only one tunnel is up | string | `1` | no |
-| vpn_tunnel_address | List the VPN tunnels you want to monitor | list | `<list>` | no |
diff --git a/cloud/aws/vpn/inputs.tf b/cloud/aws/vpn/inputs.tf
index e1e3ade..ff336dc 100644
--- a/cloud/aws/vpn/inputs.tf
+++ b/cloud/aws/vpn/inputs.tf
@@ -14,24 +14,12 @@ variable "message" {
   description = "Message sent when an alert is triggered"
 }
 
-# AWS VPN Service specific
-variable "vpn_tunnel_address" {
-  description = "List the VPN tunnels you want to monitor"
-  type        = "list"
-  default     = []
+variable "filter_tags_use_defaults" {
+  description = "Use default filter tags convention"
+  default     = "true"
 }
 
-variable "vpn_status_ok" {
-  description = "Both tunnels are up, everything is ok"
-  default     = 2
-}
-
-variable "vpn_status_warning" {
-  description = "Only one tunnel is up"
-  default     = 1
-}
-
-variable "vpn_status_critical" {
-  description = "Both tunnels are down"
-  default     = 0
+variable "filter_tags_custom" {
+  description = "Tags used for custom filtering when filter_tags_use_defaults is false"
+  default     = "*"
 }
diff --git a/cloud/aws/vpn/monitors-vpn.tf b/cloud/aws/vpn/monitors-vpn.tf
index 25501be..cef0ef1 100644
--- a/cloud/aws/vpn/monitors-vpn.tf
+++ b/cloud/aws/vpn/monitors-vpn.tf
@@ -1,22 +1,23 @@
+data "template_file" "filter" {
+  template = "$${filter}"
+
+  vars {
+    filter = "${var.filter_tags_use_defaults == "true" ? format("dd_monitoring:enabled,dd_aws_elb:enabled,env:%s", var.environment) : "${var.filter_tags_custom}"}"
+  }
+}
+
 resource "datadog_monitor" "VPN_status" {
   name    = "[${var.environment}] VPN Down {{ tunnelipaddress }}"
   message = "${var.message}"
 
   query = <<EOF
         avg(last_5m): (
-        avg:aws.vpn.tunnel_state{tunnelipaddress:${var.vpn_tunnel_address[0]}} by {region,name}
-        + avg:aws.vpn.tunnel_state{tunnelipaddress:${var.vpn_tunnel_address[1]}} by {region,name}
-      ) == ${var.vpn_status_critical}
+          avg:aws.vpn.tunnel_state{${data.template_file.filter.rendered}} by {region,name}
+        ) < 1
   EOF
 
   type = "metric alert"
 
-  thresholds {
-    ok       = "${var.vpn_status_ok}"
-    warning  = "${var.vpn_status_warning}"
-    critical = "${var.vpn_status_critical}"
-  }
-
   notify_no_data      = true
   renotify_interval   = 0
   evaluation_delay    = "${var.evaluation_delay}"