AWS, Cloud hosted router and IPSEC!

I’ve been trying to get this working, as we know AWS EC2/VPC’s are NAT’d and there is no way around this. I have tried creating an IPsec but it has not worked.

Rather than de-compile this terrible config, are there any generic pointers anyone can give for this specific setup? Surely its been done before.