AWS Client VPN
Managed OpenVPN endpoint that lets individual users reach VPC and on-premises resources from their own devices.
Verified against AWS documentation · 2026-08-24
Key facts
- 01Endpoint is associated with VPC subnets — each association is an ENI in one AZ; associate a second AZ for HA
- 02Auth modes: mutual certificate, Active Directory, or SAML — certificate auth can be layered on top of either user-based mode
- 03Access needs both a route and an authorization rule — a route on its own grants nothing
- 04Split-tunnel is off by default, so every packet from the client, including personal browsing, comes through your VPC
- 05Limits: client CIDR /22–/12 and immutable after creation, 10 routes, 50 authorization rules, 5 endpoints per Region
Exam triggers
Phrases and scenarios that point here.
- "Remote employees", "work from home", "individual laptops need access to private subnets"
- Access must differ per user or per group → Client VPN authorization rules, not Site-to-Site VPN
- Existing corporate AD or SAML IdP must gate VPN access → AD Connector or IAM Identity Center integration
- "Managed", "scales with users", "no VPN appliance to patch" paired with remote-user wording
Not this service
- A whole office or data center needs connectivity → Site-to-Site VPN
- Dedicated, consistent private bandwidth → Direct Connect
- Shell or port access to instances with no VPN at all → Systems Manager Session Manager
Use cases
- 01On-call engineers reaching private RDS, ElastiCache, or OpenSearch endpoints straight from a laptop, retiring the bastion fleet and its SSH keys
- 02Contractors placed in their own SAML group mapped to a single authorization rule, so they reach the one CIDR they're paid to touch and nothing else
- 03Full tunnel plus a NAT Gateway so all remote-worker traffic egresses from one Elastic IP — the shape SaaS vendors and partner allowlists ask for
- 04Laptop → VPC → Transit Gateway → Site-to-Site VPN, giving remote staff on-premises access without shipping anyone a hardware appliance
- 05Short-lived surge access — office outage, acquisition onboarding, a contractor sprint — where the association is torn down the day the work ends
How it's charged
- 01Two meters: per subnet association per hour, and per active client connection per hour
- 02Association billing runs around the clock whether anyone connects or not — a three-AZ endpoint with zero users still bills three associations
- 03An endpoint with no subnet associations costs nothing; the association, not the endpoint, is the meter
- 04Connection charges stop at disconnect, so a shorter session timeout (8 hours instead of the 24-hour default) trims the bill for users who never log off
- 05Full tunnel pushes personal internet traffic through your NAT Gateway — you pay processing charges and data transfer on staff web browsing
