Client VPN
AWS Client VPN is a managed OpenVPN-compatible service that lets a laptop join a private AWS network over an encrypted tunnel. The platform runs one endpoint for the whole organization, attached to the hub VPC, with sign-in through IAM Identity Center and access scoped by group.
What it does
A Client VPN endpoint terminates tunnels from the AWS VPN client. It is associated with a subnet in a VPC; traffic leaves the tunnel there and follows the VPC's route tables. Two kinds of rule govern reach: authorization rules say which users or groups may reach which CIDR, and routes say how to get there; a rule without a matching route is silently useless. Split tunnel sends only the listed routes through the VPN and everything else over the local connection. Authentication can be certificate-based or federated with SAML, in which case the identity provider's group memberships arrive in the assertion.
How BuiltForProd uses it
The client-vpn unit (module modules/client-vpn, listed by the core/network/global stack file) is an organization-wide singleton: one endpoint, in the home region, serving every region in the VPC map. It is off by default (enable_client_vpn = false) until two prerequisites exist: a server certificate imported into ACM, and two SAML applications in Identity Center, one for the VPN and one for the self-service portal, whose metadata files sit beside the stack file.
Configuration when on:
| Setting | Value |
|---|---|
| Client address range | 172.16.0.0/21 from the VPC map, outside the organization supernet so it can never overlap a VPC |
| Association | One private subnet of the hub VPC (single AZ, about $73 per month per association) |
| Tunnel mode | Split tunnel by default; full tunnel is estimated at $200 to $600 per month more for a 20-user team |
| Full tunnel | split_tunnel = false adds a 0.0.0.0/0 route per associated subnet and a matching authorization rule, so clients reach the internet through the hub NAT |
| Session | 8 hours; self-service portal enabled |
| DNS | The hub VPC resolver, so private hosted zones resolve |
| Logging | Connection logs to CloudWatch, 365 days |
Access is a group_access matrix in the unit definition: an SSO group name maps to "all" or to a list of stage keys. Platform Leads, Platform Engineers and auditors get all; DevOps Leads get every plat-* stage; DevOps Engineers and lead developers get staging, dev and sandbox; developers get dev and sandbox. The module expands the matrix against the per-region VPC CIDRs from IPAM into concrete authorization rules and routes from one list, so every rule has a route by construction. With the default matrix and one region that is 42 rules and 5 routes. Broad ranges such as 10.0.0.0/8 are never used as rules.
The matrix is what split tunnel is for. A full-tunnel endpoint needs a 0.0.0.0/0 authorization rule to give clients any internet at all, and a rule for every destination covers every stage too, so the narrower per-group rules stop restricting anything. Stay on split tunnel where per-group segmentation matters.
Because Identity Center puts group IDs, not names, into the SAML assertion, the unit holds a group-id map that is filled in per deployment. Reaching a second region over the VPN also needs Transit Gateway inter-region peering to be switched on for that region.
Terms you will see
| Term | Meaning |
|---|---|
| Endpoint | The Client VPN resource that terminates tunnels. |
| Client CIDR | The address range assigned to connected clients; 172.16.0.0/21. |
| Authorization rule | Permission for a group to reach one CIDR. |
| Route | The path from the endpoint to a CIDR; every rule has one here. |
| Split tunnel | Only VPN-routed destinations use the tunnel; the default. |
| Full tunnel | All client traffic goes over the VPN and out through the hub NAT. |
| Self-service portal | The AWS page where users download the client and configuration. |
| Server certificate | The ACM certificate the endpoint presents to clients. |
Where to read more
- AWS Baseline overview for the remote-access path in the network diagram.
- Transit Gateway for how VPN traffic reaches each spoke.
- Easy-RSA and the VPN client for the certificate and client side.