Mutual authentication
Authenticates devices with client certificates. Block lost devices with a certificate revocation list. This method is also required to evaluate device posture with a client connect handler.
ACMCRL 20,000 entriesAWS Client VPN · Managed remote access
From anywhere, only authenticated users reach the networks they need
AWS Client VPN is a managed VPN for reaching AWS and on-premises resources with an OpenVPN-based client. Users authenticate with certificates, Active Directory or a SAML 2.0 IdP, and access is scoped by user group and destination CIDR. There are no VPN servers to run or scale.
Client VPN endpointOpenVPN · TLS
cvpn-endpointavailable
- Authentication
Mutual certActive DirectorySAML 2.0- Transport
UDPTCP4431194- Client CIDR
10.100.0.0/22- Split tunnel
enabled- Pushed routes
10.0.0.0/16172.16.0.0/24- Target
VPC subnetsTransit Gateway
Highlighted values are the settings chosen in this example. The transport protocol can't be changed after the endpoint is created.
99.9%
Monthly uptime SLA per Region
3
Authentication methods (certificate · AD · SAML)
443 · 1194
Supported ports, TCP · UDP
/22–/12
Client IPv4 CIDR size range
Why Client VPN
Manage remote access like any other cloud resource
Running your own VPN appliances means handling capacity planning, patching and redundancy yourself. Client VPN scales with the number of users and ties authentication and access control to your existing identity system.
Managed
No servers to run
Create an endpoint and associate subnets or a transit gateway. AWS manages capacity as the number of users changes.
Identity
Use your existing identity system
Use Active Directory through AWS Directory Service or a SAML 2.0 IdP, and keep your IdP's MFA.
Scoped
Per-group access scope
Authorization rules define which networks each group can reach. Destinations without a rule are blocked by default.
Authentication
Three authentication methods
With any method, the server certificate must be in AWS Certificate Manager (ACM) in the same Region as the endpoint. Certificate-based authentication can be combined with user-based authentication.
Active Directory
Authenticates with user credentials from a directory connected to AWS Directory Service. The directory must be in the same account as the endpoint.
AWS Directory ServiceMFAAD groupsSAML 2.0 federation
Federates with an external IdP such as Okta through an IAM SAML identity provider for SSO. Users connect with the AWS provided client.
SAML 2.0IAM SAML providerSSOSupported combinationsMutual + Active DirectoryMutual + SAMLWhen both are configured, users must pass both to connect.
Authorization rules
Decide who can go where
An authorization rule pairs a destination CIDR with a group ID (or all users). You can only create allow rules, and the most specific prefix wins.
Authorization rules · longest prefix match
10.0.0.0/16group: devallow
10.0.2.119/32group: managersallow
172.16.0.0/24all usersallow
0.0.0.0/0group: managersallow
No-rule destinationgroups other than managersdeny
- Deny by defaultWithout authorization rules, no destination is reachable. Add rules first after creating the endpoint.
- Most specific rule winsIn the example above, the 10.0.2.119/32 rule is open only to managers, so the dev group can't reach that host even though it's inside 10.0.0.0/16.
- 0.0.0.0/0 is evaluated lastIt means any destination not defined by another rule and is evaluated last regardless of creation order.
Features
Key features
Routing
Split tunnel
When enabled, only the routes in the endpoint route table are pushed to clients, so only that traffic goes through the tunnel. Off by default, sending all traffic through the tunnel.
Visibility
Connection logs
Send connection attempts, connections and terminations to Amazon CloudWatch Logs for usage analysis and incident investigation.
Custom logic
Client connect handler
A Lambda function allows or denies the connection after authentication and before authorization rules are evaluated. The function name must start with AWSClientVPN- and the timeout is 30 seconds.
Device posture
Device posture checks
Evaluate Cedar-based policies using data from CrowdStrike, Jamf or JumpCloud device trust providers, at connection time and every 5 minutes during the session. Validate first in shadow mode, which logs without blocking. Requires AWS provided client 6.2.0 or later.
Distribution
Self-service portal
Users download the AWS provided client and the endpoint configuration file from the portal themselves, so you don't have to distribute configuration files. Client 6.x also supports a CLI and administrator profile controls.
Session
Session control · login banner
Set the maximum session duration (8, 10, 12 or 24 hours; 24 by default) and reconnect behavior on expiry, plus a banner (up to 1,400 characters) shown at connection.
Target network
VPC subnet association vs. Transit Gateway attachment
Choose one connection method when you create the endpoint. The two can't be mixed on one endpoint.
| Method | Reach | Client IP | Access control | Best for |
|---|---|---|---|---|
| VPC subnet association Subnet association |
The associated VPC and networks routed from it | SNAT to the endpoint network interface address | Authorization rules and security groups | Remote access centered on one VPC |
| Transit Gateway attachment client-vpn attachment |
Multiple VPCs and on-premises networks attached to a transit gateway in the same Region | Original client IP preserved, no SNAT | Network-based authorization rules (no security groups) | Reaching many VPCs without a transit VPC and tracking traffic per user |
Reference architecture
From remote users to VPCs and on-premises
Users establish a TLS tunnel to the endpoint with an OpenVPN-based client, and the endpoint authenticates them against an IdP or directory. An endpoint attached to a transit gateway sends traffic to multiple VPCs and on-premises while preserving the original client IP.
On narrow screens, swipe the diagram sideways.
Getting started
How to set up an endpoint
- STEP 1
Prepare authentication
Put the server certificate in ACM, and prepare client certificates, a directory or a SAML provider.
- STEP 2
Create the endpoint
Set the client CIDR, transport protocol, split tunnel and connection logging.
- STEP 3
Associate the target network
Associate VPC subnets, or wait until the Transit Gateway attachment is available.
- STEP 4
Authorization rules · routes
Add per-group authorization rules and destination routes, and make sure the VPC has a return route to the client CIDR.
- STEP 5
Distribute the client
Export the configuration file or enable the self-service portal, and share instructions with users.
Pricing
What you pay for
You're billed hourly for the number of target networks associated with the endpoint and the number of concurrently active client connections. Logging, Lambda and data transfer are added at each service's rates.
| Charge | Billed by | Notes |
|---|---|---|
| Endpoint association | Per hour for each target network association | IPv6 and dual-stack endpoints have the same rate as IPv4. |
| Client connections | Per hour for each active VPN connection | Scales with the number of connected users. |
| Data transfer | Data transfer out (DTO) from EC2 to the internet | Sending internet traffic through a full tunnel increases this cost. |
| Public IPv4 addresses | Public IPv4 addresses used by client connection tunnels | Standard public IPv4 address rates apply (see the VPC pricing page). |
| Connection logs | CloudWatch Logs log group usage | Billed at CloudWatch rates. |
| Client connect handler | Lambda function invocations | Billed at AWS Lambda rates. |
| Transit Gateway attachment | Standard Transit Gateway rates | The Transit Gateway integration itself has no additional charge. |
Rates vary by Region and usage. For current rates, see the AWS VPN pricing page.
Next step
Design remote access for your organization
Bring your user count, the IdP or directory you use and the networks users need to reach, and we'll review authentication and authorization rule design together.