AWS Client VPN
- What it is
- Managed, elastic remote-access VPN. Individual users connect from a laptop or phone into AWS and on-premises networks.
- Based on OpenVPN, so it works with the standard OpenVPN client.
- Key traits
- Scales automatically with the number of connected users — no VPN concentrator to size.
- Billed per endpoint-hour plus per active connection-hour, so cost tracks actual remote-worker usage.
- Authentication: Active Directory via AWS Directory Service, SAML federation through AWS IAM Identity Center or an external IdP, or mutual certificate authentication.
- Authorization rules control which network ranges each AD group may reach — not just all-or-nothing network access.
- Split tunnel sends only AWS-destined traffic through the VPN, leaving general internet traffic local.
- Not to be confused with
- AWS Site-to-Site VPN — connects a whole network, always on, no per-user identity.
- Amazon WorkSpaces Web — browser isolation with no network-level access at all; often the lighter alternative for contractors who only need internal web apps.