AWS Client VPN Stack

AWS Client VPN via CloudFormation

A complete CloudFormation stack that provisions an AWS Client VPN endpoint with mutual TLS authentication, split-tunnel routing that only sends AWS-bound traffic through the VPN, and CloudWatch logging for every connection event.

What's Included

• Client VPN endpoint with mutual certificate authentication (no SSO required)
• Split-tunnel configuration — only RFC-1918 and VPC CIDR routes go through the tunnel
• Authorization rules scoped to specific subnets or target groups
• CloudWatch log group with connection start/end events
• ACM certificate import helper script for server and client certs
• Security group with least-privilege egress rules

What You Get

• client-vpn.yaml — CloudFormation template
• gen-certs.sh — script to generate server and client certificates with easy-rsa
• import-certs.sh — imports generated certs to ACM and outputs ARNs for the stack
• client-config.ovpn — template OpenVPN config for end users
• README.md — cert generation walkthrough, deployment steps, and user onboarding guide

Requirements

• AWS account with CloudFormation, ACM, and EC2:ClientVpn permissions
• easy-rsa installed locally for certificate generation
• AWS CLI v2 configured for the target account and region