AWS Client VPN
AWS Client VPN is a managed, client-based VPN service of Amazon Web Services that lets individual users securely connect to resources in a Amazon VPC and on-premises networks from any location, using an OpenVPN-based client. It addresses individual remote-user access, unlike AWS Site-to-Site VPN, which joins two whole networks together.
Key points
- Establishes encrypted TLS connections from any location through an OpenVPN-based client, rather than linking entire on-premises networks the way Site-to-Site VPN does.
- Fully managed: AWS handles deployment, scaling, and maintenance, and the service scales elastically to varying numbers of connecting users.
- Authentication options: Active Directory integration, SAML-based federated authentication, and mutual (certificate-based) authentication — selectable per Client VPN endpoint.
- Access control is enforced through authorization rules, which grant specific user or Active Directory/identity-provider groups access to specific destination CIDR ranges; access is denied by default until explicitly authorized.
- A Client VPN endpoint is the termination point for client sessions and associates with either VPC subnets or a direct AWS Transit Gateway attachment.
- Supports IPv4, IPv6, and dual-stack endpoints and traffic, using ports 443 or 1194 over TCP or UDP (port 443 by default).
- Provides connection logging and a self-service portal so end users can download the VPN client and their endpoint configuration file.
- Billed hourly per endpoint association and per active VPN connection, plus standard data transfer, CloudWatch Logs, and Lambda charges for optional features like connection logging or a client connect handler.