Easy-RSA and the AWS VPN client

Two small tools sit at either end of the AWS Baseline's remote access path. Easy-RSA produces the server certificate that identifies the Client VPN endpoint, and the AWS VPN client is the desktop application an engineer uses to connect. Neither is an AWS service; both are needed for the Client VPN to work.

What it does

Easy-RSA is a command-line wrapper around OpenSSL for running a small certificate authority (CA). It creates a CA, then issues certificates signed by it. AWS Client VPN needs a server certificate in AWS Certificate Manager (ACM); Easy-RSA is the tool AWS documents for producing one when you do not have a public certificate for the endpoint.

The AWS VPN client is the OpenVPN-based application from AWS for Windows, macOS and Ubuntu. It imports an .ovpn profile, opens the tunnel, and for SAML-authenticated endpoints opens a browser for the sign-in.

How BuiltForProd uses it

Certificate. The client-vpn unit in the network account needs server_certificate_arn. The Baseline ships a one-time helper under scripts/ that runs Easy-RSA to create a CA and a server certificate, imports the server certificate into ACM in the home region, and stores the CA private key in Secrets Manager at /acme/vpn/ca-private-key for later rotation. The certificate authenticates the endpoint to clients; it is not used for client authentication. Clients authenticate through SAML federation with IAM Identity Center, so there are no client certificates to issue or revoke. The deployment guide recommends rotating the server certificate annually by repeating the process and updating the ARN.

Connecting. Once enable_client_vpn is true, an engineer:

1. Downloads the .ovpn configuration from the self-service portal (self_service_portal = "enabled", signed in with SSO) or receives it from an administrator.
2. Installs the AWS VPN client and imports the file as a profile.
3. Connects. A browser window opens for IAM Identity Center; after sign-in, the SAML assertion carries the user's group memberships and the tunnel comes up for an 8-hour session.
4. Reaches only what the group is allowed to. The unit's group_access matrix maps each SSO group to stages (application developers reach dev and sandbox; platform leads reach everything), and the module turns it into authorization rules with matching routes.

The tunnel is split by default: only traffic to the organization's address space goes through the VPN, and the hub VPC resolver is pushed to the client so private zones such as internal.company.com resolve. Connection events are logged to CloudWatch for 365 days.

Terms you will see

Term	Meaning
Certificate authority	The private CA Easy-RSA creates; its key is kept in Secrets Manager.
Server certificate	The ACM certificate the endpoint presents to clients.
.ovpn profile	The configuration file the AWS VPN client imports.
Self-service portal	The AWS page where signed-in users download the profile and client.
Split tunnel	Only internal destinations use the VPN; everything else stays local.

Where to read more

• Client VPN for the endpoint itself
• ACM for where the certificate is stored
• IAM Identity Center for the sign-in and groups
• AWS Baseline overview