diff --git a/heat/engine/resources/openstack/neutron/vpnservice.py b/heat/engine/resources/openstack/neutron/vpnservice.py
index 2e2b4bef1a..1c4f85ec41 100644
--- a/heat/engine/resources/openstack/neutron/vpnservice.py
+++ b/heat/engine/resources/openstack/neutron/vpnservice.py
@@ -197,9 +197,15 @@ class VPNService(neutron.NeutronResource):
     def check_create_complete(self, data):
         attributes = self._show_resource()
         status = attributes['status']
-        if status == 'PENDING_CREATE':
-            return False
-        elif status == 'ACTIVE':
+        # The Neutron VPN service doesn't hit the ACTIVE status until
+        # it has a matching site-to-site connection. However, it is
+        # required that the VPNService resource be in CREATE_COMPLETE,
+        # in order for the IPsecSiteConnection resource to progress to
+        # CREATE_IN_PROGRESS. The only way to resolve this catch-22 is
+        # to already consider the VPNService resource complete, even
+        # when its underlying Neutron VPN service object is still in
+        # PENDING_CREATE.
+        if status in ['PENDING_CREATE', 'ACTIVE']:
             return True
         elif status == 'ERROR':
             raise exception.ResourceInError(
diff --git a/heat/tests/openstack/neutron/test_neutron_vpnservice.py b/heat/tests/openstack/neutron/test_neutron_vpnservice.py
index 003d5bdd6f..1d1b4d3b6d 100644
--- a/heat/tests/openstack/neutron/test_neutron_vpnservice.py
+++ b/heat/tests/openstack/neutron/test_neutron_vpnservice.py
@@ -187,7 +187,6 @@ class VPNServiceTest(common.HeatTestCase):
         rsrc = self.create_vpnservice()
 
         self.mockclient.show_vpnservice.side_effect = [
-            {'vpnservice': {'status': 'PENDING_CREATE'}},
             {'vpnservice': {'status': 'ERROR'}},
         ]
 
diff --git a/releasenotes/notes/vpnservice-pending-create-f261c5dfc290a734.yaml b/releasenotes/notes/vpnservice-pending-create-f261c5dfc290a734.yaml
new file mode 100644
index 0000000000..97b01097c8
--- /dev/null
+++ b/releasenotes/notes/vpnservice-pending-create-f261c5dfc290a734.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Enable the creation of an ``OS::Neutron::VPNService`` resource,
+    and an ``OS::Neutron::IPsecSiteConnection`` resource that depends
+    on it, within the same stack.