diff --git a/packages/@aws-cdk/aws-ec2/lib/vpn.ts b/packages/@aws-cdk/aws-ec2/lib/vpn.ts
index 4683180d2af84..19fb4f963acd3 100644
--- a/packages/@aws-cdk/aws-ec2/lib/vpn.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/vpn.ts
@@ -224,7 +224,7 @@ export class VpnConnection extends Resource implements IVpnConnection {
       });
     }
 
-    if (!net.isIPv4(props.ip)) {
+    if (!Token.isUnresolved(props.ip) && !net.isIPv4(props.ip)) {
       throw new Error(`The \`ip\` ${props.ip} is not a valid IPv4 address.`);
     }
 
diff --git a/packages/@aws-cdk/aws-ec2/test/vpn.test.ts b/packages/@aws-cdk/aws-ec2/test/vpn.test.ts
index 72be541bf45e2..4cf8880c3b0ab 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpn.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpn.test.ts
@@ -1,5 +1,5 @@
 import { expect, haveResource } from '@aws-cdk/assert';
-import { Duration, Stack } from '@aws-cdk/core';
+import { Duration, Stack, Token } from '@aws-cdk/core';
 import { nodeunitShim, Test } from 'nodeunit-shim';
 import { PublicSubnet, Vpc, VpnConnection } from '../lib';
 
@@ -322,4 +322,24 @@ nodeunitShim({
     }));
     test.done();
   },
+  'can add a vpn connection with a Token as customer gateway ip'(test:Test) {
+    // GIVEN
+    const stack = new Stack();
+    const token = Token.asAny('192.0.2.1');
+
+    // WHEN
+    new Vpc(stack, 'VpcNetwork', {
+      vpnConnections: {
+        VpnConnection: {
+          ip: token as any,
+        },
+      },
+    });
+
+    // THEN
+    expect(stack).to(haveResource('AWS::EC2::CustomerGateway', {
+      IpAddress: '192.0.2.1',
+    }));
+    test.done();
+  },
 });