Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS Client VPN provides managed, remote-access connectivity from individual user devices to resources in an Amazon VPC. It is designed for employees, contractors, or administrators who need to access private AWS workloads from home, branch locations, or while traveling.
Client VPN is different from AWS Site-to-Site VPN, which connects networks to AWS. Client VPN connects end-user devices using an OpenVPN-based client and SSL/TLS encryption.
Key Concepts
Managed OpenVPN-Based Remote Access
AWS Client VPN is a fully managed VPN service based on OpenVPN. Remote users install a compatible client on Windows, macOS, or Linux and connect to a Client VPN endpoint over the internet.
The connection uses SSL/TLS, commonly over TCP port 443, helping users connect through many restrictive networks while protecting traffic in transit.
Client VPN Endpoint
The Client VPN endpoint is the AWS-managed logical endpoint through which users connect. During configuration, you specify:
- A client IPv4 CIDR range used to assign addresses to connected clients
- The authentication method
- Authorization rules controlling access to destinations
- One or more target network associations
- DNS and other client connection settings as required
The client CIDR range must not overlap with the VPC, connected networks, or the networks from which clients connect. Choosing a non-overlapping range is essential for predictable routing.
Target Network Associations and ENIs
A Client VPN endpoint must be associated with one or more subnets in the target VPC. These associations create AWS-managed elastic network interfaces in the selected subnets, giving the endpoint a network presence in the VPC.
The associated subnet is not necessarily a public subnet. A private subnet can be used when its route table, security groups, and network paths provide the required connectivity.
For high availability, associate the endpoint with subnets in multiple Availability Zones. This provides multiple target networks and avoids depending on a single subnet or Availability Zone.
Routing and Authorization Are Separate
Two controls must work together before a user can reach a resource:
- Routes determine whether traffic to a destination can be sent through the Client VPN endpoint.
- Authorization rules determine whether the connected user or group is allowed to access that destination.
For example, a route to a VPC CIDR range may make the destination reachable through the endpoint, while an authorization rule limits access to only members of a particular Active Directory group.
The destination workload must also permit the traffic. Security groups, network ACLs, operating-system firewalls, and application-level controls still apply.
Authentication Options
AWS Client VPN supports several authentication approaches:
- Active Directory authentication, useful when identities and groups are managed in AWS Managed Microsoft AD or an integrated directory
- Mutual certificate authentication, in which both the client and server use certificates for authentication
- Federated authentication using SAML 2.0, allowing an external identity provider to authenticate users
Authentication establishes who the user is. Authorization rules then determine which network destinations that user or group can access.
Client Connection Workflow
A typical deployment follows this sequence:
- Create a Client VPN endpoint and choose its client CIDR range.
- Configure authentication, such as Active Directory, SAML, or mutual certificates.
- Associate the endpoint with one or more VPC subnets.
- Configure routes for the VPC networks or other reachable destinations.
- Create authorization rules for users or groups.
- Configure security groups and network ACLs for the target resources.
- Export the client configuration file.
- Users install an OpenVPN-compatible client and import the configuration.
- Users authenticate and receive an address from the client CIDR range.
- AWS evaluates routes and authorization rules before forwarding permitted traffic to the VPC.
Architecture Decision Guide
| Requirement | Appropriate choice | Reason |
|---|---|---|
| Remote employees need access to private VPC resources | AWS Client VPN | Provides user/device-based remote access through an OpenVPN client |
| An entire office network must connect to a VPC | AWS Site-to-Site VPN or AWS Direct Connect | These connect networks rather than individual users |
| Users need access only to selected VPC CIDR ranges | Client VPN routes plus authorization rules | Routing and identity-based authorization can restrict reachability |
| Centralized user and group management is required | Active Directory or SAML authentication | Integrates VPN access with organizational identities |
| Certificate-based device authentication is required | Mutual certificate authentication | Requires valid client certificates in addition to server authentication |
| The endpoint must tolerate an Availability Zone failure | Associate target networks in multiple Availability Zones | Provides multiple subnet associations and improves resilience |
| The endpoint must reach private workloads | Associate with suitable VPC subnets and configure routes and security controls | Public subnet placement is not required for private resource access |
Exam-Relevant Takeaways
- AWS Client VPN is for remote individual clients, not primarily for connecting an entire customer network.
- It is an OpenVPN-based, managed service that uses SSL/TLS for encrypted client connections.
- Clients connect to a Client VPN endpoint, not directly to an EC2 instance or a VPC gateway.
- The endpoint must be associated with one or more VPC subnets, creating network interfaces in those subnets.
- Use associations in multiple Availability Zones when designing for resilience.
- Authentication and authorization are different stages. A successfully authenticated user may still be denied by authorization rules.
- Authorization rules can use user or group identity to restrict access to specific network ranges.
- The client CIDR range must not overlap with the VPC or other connected networks.
- Security groups and network ACLs remain relevant after Client VPN authorization allows the traffic.
- The downloaded client configuration file is used by the end-user VPN software to establish the connection.
Common Exam Traps
Confusing Client VPN with Site-to-Site VPN
Client VPN is intended for remote user devices. Site-to-Site VPN creates an encrypted connection between an external network and AWS, usually through a customer gateway and a virtual private gateway or transit gateway.
Assuming a Public Subnet Is Required
A Client VPN target network association is made with a VPC subnet, but that subnet does not have to be public. The important factors are subnet routing, security groups, network ACLs, and connectivity to the destination resources.
Treating Authentication as Authorization
Authentication answers, “Who is this user?” Authorization answers, “What can this user access?” A user can pass authentication and still be denied access to a VPC CIDR range because no matching authorization rule exists.
Forgetting the Client CIDR Overlap Requirement
An overlapping client address range can cause routing ambiguity and prevent reliable communication. Select a dedicated, non-overlapping range during endpoint creation.
Ignoring the Destination Security Group
Client VPN authorization does not bypass workload security controls. The target EC2 instance or other resource must allow the relevant traffic from the effective source range or security context.
Using a Single Target Subnet for a Resilient Design
Associating only one subnet creates a dependency on one Availability Zone. For production access, use target network associations in multiple Availability Zones where supported by the design.
Real-World Engineer Notes
- Plan the address space before creating the endpoint. Include VPC CIDRs, peered networks, Transit Gateway-connected networks, on-premises ranges, and the users’ likely source networks when selecting the client CIDR.
- Keep authorization rules narrow. Grant access to required destinations rather than exposing the entire VPC by default.
- Use directory groups to make access policy easier to manage as personnel and responsibilities change.
- Treat the exported client configuration as sensitive operational material. Distribute it through controlled channels and protect any associated certificates or credentials.
- Test the complete path: client connection, Client VPN route, authorization rule, subnet route table, security groups, network ACLs, and the application listener.
- If users need access to more than the directly associated VPC, verify that the VPC route tables and any Transit Gateway, peering, or hybrid connectivity paths support return traffic.
- Monitor connection and client activity logs when operational visibility or security investigations require them.
Quick Reference Summary
- Service purpose: Managed remote-user VPN access to AWS VPC resources
- Client technology: OpenVPN-compatible software
- Encryption: SSL/TLS tunnel, commonly using TCP 443
- Endpoint placement: Associate the endpoint with one or more VPC subnets
- Network presence: AWS creates managed network interfaces in associated subnets
- Authentication: Active Directory, mutual certificates, or SAML federation
- Access control: Routes plus authorization rules, followed by normal VPC security controls
- Resilience: Associate target networks across multiple Availability Zones
- Critical planning rule: The client CIDR range must not overlap with connected networks
- Best alternative for whole-network connectivity: Site-to-Site VPN or Direct Connect
Flashcards
- Q: What is AWS Client VPN designed to connect?
A: Individual remote user devices to resources in an AWS VPC.
- Q: What client technology does AWS Client VPN use?
A: An OpenVPN-based client using SSL/TLS encryption.
- Q: What must be associated with a Client VPN endpoint before it can access VPC resources?
A: One or more target VPC subnets.
- Q: What does a target network association create in the VPC?
A: An AWS-managed elastic network interface in the associated subnet.
- Q: Name three Client VPN authentication options.
A: Active Directory, mutual certificate authentication, and SAML-based federated authentication.
- Q: What is the difference between authentication and authorization in Client VPN?
A: Authentication verifies the user’s identity; authorization determines which destinations that identity may access.
- Q: Why must the Client VPN client CIDR range be non-overlapping?
A: Overlap can create routing ambiguity with the VPC or other connected networks.
- Q: Is a public subnet required for a Client VPN target network association?
A: No. A suitable private subnet can be used if routing and security controls support the required traffic.
- Q: What additional control must allow traffic after Client VPN authorization succeeds?
A: The destination’s security groups, network ACLs, host firewall, and application controls must permit it.
- Q: How should a Client VPN endpoint be designed for Availability Zone resilience?
A: Associate it with target subnets in multiple Availability Zones.
Practice Questions
Question 1
A company wants employees working from home to access private EC2 instances in a VPC. Each employee uses a managed laptop, and access must be restricted according to Active Directory groups. Which solution best meets the requirement?
A. Create an AWS Site-to-Site VPN for every employee laptop
B. Deploy AWS Client VPN with Active Directory authentication and group-based authorization rules
C. Assign public IP addresses to the EC2 instances and restrict access using security groups
D. Create a VPC peering connection to each employee’s home network
Correct answer: B
Explanation: AWS Client VPN provides managed remote-user connectivity and supports Active Directory authentication and group-based authorization. Site-to-Site VPN is intended for network-to-network connectivity, while public exposure is unnecessary and less appropriate for private workloads.
Question 2
An architect configures AWS Client VPN with a client CIDR range that overlaps the VPC CIDR. Users can connect and authenticate, but traffic to private subnets behaves unpredictably. What is the most likely cause?
A. Client VPN supports only UDP traffic
B. The endpoint must be associated with a public subnet
C. The client CIDR overlaps with the VPC address space
D. SAML authentication cannot be used with private subnets
Correct answer: C
Explanation: The Client VPN client CIDR must not overlap with the VPC or other connected networks. Overlap can produce ambiguous routes and unreliable traffic forwarding.
Question 3
A user successfully authenticates to a Client VPN endpoint but cannot connect to an EC2 instance. The endpoint has a route to the instance’s subnet, but the instance’s security group does not allow the relevant client traffic. What should the architect do?
A. Disable Client VPN authorization rules
B. Add an appropriate inbound rule to the instance security group
C. Move the instance to a public subnet
D. Replace Client VPN with Direct Connect
Correct answer: B
Explanation: Client VPN authorization and routing do not bypass VPC security controls. The instance security group must allow the required protocol and port from the appropriate source.
Question 4
A production Client VPN endpoint is currently associated with a subnet in only one Availability Zone. The company wants to reduce the effect of an Availability Zone failure. Which change is most appropriate?
A. Create a second Client VPN endpoint with the same overlapping client CIDR
B. Associate the existing endpoint with suitable subnets in additional Availability Zones
C. Add a public IP address to each target EC2 instance
D. Replace the Client VPN endpoint with a NAT gateway
Correct answer: B
Explanation: Associating the endpoint with target networks in multiple Availability Zones improves resilience by avoiding dependence on a single target subnet and Availability Zone. A NAT gateway does not provide remote-user VPN connectivity.
Question 5
A business needs to connect its entire corporate data center network to AWS so that applications and servers can communicate without installing VPN software on each user device. Which service is generally the better fit?
A. AWS Client VPN
B. AWS Site-to-Site VPN
C. Amazon Cognito
D. AWS PrivateLink endpoint service
Correct answer: B
Explanation: Site-to-Site VPN is designed for encrypted network-to-network connectivity. Client VPN is designed for individual remote user devices and requires client software.