AWS Client VPN
Managed remote-access VPN for users: OpenVPN-based TLS connections, Client VPN endpoints and target network associations, authentication with Active Directory, certificates, or SAML federation, authorization rules, split tunnel, security groups, logging, and pricing.
3 min read · Last reviewed · SAA-C03
Loading your progress
Sign in to bookmark tutorials and track what you have read.
On this page
What it is
AWS Client VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry is a managed, client-based VPN service that lets individual users securely access AWS resources and On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry networks from any location, using an OpenVPN-based VPN client. AWS runs and scales the VPN service, so you don't deploy or maintain remote access VPN servers.
Choose Client VPN when a question asks how remote employees or contractors can securely reach private resources in a VPC (and through it, on premises) from their laptops. To connect a whole office or data center, use Site-to-Site VPN.
Concepts
- Client VPN endpoint: the resource that clients connect to, with a client IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry address range.
- Target network associations: SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry in a VPC that the endpoint is associated with. Associate subnets in several AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry for availability.
- Authentication: Active Directory (user-based), mutual certificate-based authentication, or SSO (Single sign-on)Signing in once to reach many applications or accounts without signing in to each again. AWS IAM Identity Center provides single sign-on to AWS accounts and applications.Glossary entry with SAML (Security Assertion Markup Language)An XML-based standard for passing sign-in information from an identity provider, such as Microsoft Entra ID or Okta, to a service. AWS accepts SAML 2.0 for single sign-on, directly in IAM or through IAM Identity Center.Glossary entry federation (user-based). You can combine mutual authentication with a user-based method.
- Authorization rules: act like firewall rules that grant specific users or groups access to specific networks.
- Route table: the endpoint's routes to the VPC, peered VPCs, on-premises networks (through the VPC's VPN or Direct Connect), or the internet.
- Split tunnel: by default, all client traffic goes through the VPN. With split tunnel, only traffic for the networks in the endpoint's route table uses the VPN, and other traffic uses the user's local internet connection.
- Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry apply to the endpoint's network interfaces in the associated subnets.
- Endpoints support IPv4, IPv6, or dual stack.
Security, resilience, performance, and cost
Security
- Connections are encrypted with TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry. Use federated or Active Directory authentication with MFA (Multi-factor authentication)Signing in with two or more different kinds of proof, such as a password plus a code from a phone app or a security key. AWS recommends MFA for the root user and for every human user.Glossary entry, narrow authorization rules, and security groups.
- Turn on connection logging to CloudWatch Logs.
Resilience and performance
- Managed and elastic: it scales with the number of users. Associate subnets in multiple Availability Zones.
Cost
- Pay per endpoint association per hour and per active client connection per hour. Split tunnel can reduce data transfer through AWS.
Client VPN or another option?
| If the requirement is | Choose |
|---|---|
| Remote users reach private VPC resources securely | AWS Client VPN |
| Connect an office or data center network | AWS Site-to-Site VPN |
| Dedicated connection for a data center | AWS Direct Connect |
| Admin shell access to instances without a VPN | Systems Manager Session Manager |
Reverse mindmap: when the question points here
- Yes, when the question says
- Remote employees access private resources leads to Client VPN
- Managed OpenVPN-based remote access leads to Client VPN
- Configure it
- Sign in with corporate SSO leads to SAML federated authentication
- Use Active Directory users leads to AD authentication
- Device certificates leads to Mutual authentication
- Only some users reach some networks leads to Authorization rules
- Internet traffic shouldn't go through AWS leads to Split tunnel
- No, when the question says
- Connect the whole office leads to Site-to-Site VPN
- Shell access to EC2 only leads to Session Manager
Key takeaways
- Client VPN is a managed, OpenVPN-based remote access service for individual users.
- Endpoints are associated with VPC subnets; authorization rules and security groups control access.
- Authenticate with Active Directory, mutual certificates, or SAML federation, or combine them.
- Split tunnel sends only AWS-bound traffic through the VPN.
- Pay per endpoint association-hour and per connection-hour.
Sources
- AWS Client VPN Administrator Guide: What is AWS Client VPN?
- AWS Client VPN Administrator Guide: How AWS Client VPN works
- AWS Client VPN Administrator Guide: Client authentication
- AWS Client VPN Administrator Guide: Client VPN endpoints
- AWS Client VPN Administrator Guide: Authorization rules
- AWS Client VPN Administrator Guide: Split-tunnel
- AWS Client VPN Administrator Guide: Target networks
- AWS Client VPN Administrator Guide: Connection logging
- AWS VPN pricing