All Services

Networking & CDN

AWS Client VPN

AWS Client VPN is a managed, OpenVPN-based remote-access service that connects authenticated users to VPC and connected-network resources using endpoint associations, routes, authorization rules, security groups, certificates or federated identity, and connection logs.

Explore pricing models, common use cases, infrastructure support, and the AWS services that commonly work with AWS Client VPN.

AWS Client VPN pricing and cost programs

Pricing model: Managed client VPN usage

On-Demand
Available
Reserved Instances or reserved capacity
Not applicable
Savings Plans
Not applicable
Spot
Not applicable

Billing dimensions: Endpoint association hours · Client connection hours · Public IPv4 addresses

Programs and modes: Client VPN endpoints · Subnet associations · Active client connections

Both endpoint associations and active connections can incur hourly charges.

Free Tier: Service-specific — verify current offers

Pricing reviewed 2026-07-25. Reviewed against the linked official AWS pricing page. Recheck regional rates and program terms before purchase.

Official AWS pricing

Official AWS sources reviewed 2026-07-21.

Why implement AWS Client VPN?

  • Provides elastic remote-user VPN termination without operating concentrators or patching VPN appliances.
  • Supports mutual certificate, Active Directory, and SAML federation authentication, including MFA through the selected identity provider.
  • Uses network-based authorization, split or full tunnel routing, security groups, endpoint policies and logs to govern VPC and connected-network access.

How to implement AWS Client VPN

  1. Define user and group identities, MFA, certificate lifecycle, client CIDR that does not overlap destinations, split-tunnel policy, DNS, ports, destinations, session timeout, logging, availability and incident response.
  2. Create the endpoint with approved authentication and server certificate, associate subnets in multiple Availability Zones, apply security groups, add an identical route to each association, and create least-privilege authorization rules per group and destination.
  3. Distribute protected client configuration, test authentication, authorization, DNS and routes from supported clients, enable connection logs, monitor active sessions and quotas, and revoke certificates, sessions and group access promptly.

AWS Client VPN best practices

  • Use federated or directory identities with MFA where possible, least-privilege authorization rules and security groups, short sessions, individual accountability, and an explicit joiner-mover-leaver process.
  • Associate at least two subnets for availability, keep routes consistent across associations, choose split tunnel deliberately, and prevent unintended routes from reaching the client through overlapping networks.
  • Enable connection logging but know its boundary: AWS documents that failed mutual-authentication attempts are not recorded there, so also monitor certificate issuance, identity-provider events and CloudTrail configuration changes.

AWS Client VPN use cases and server impact

  • Remote employee VPC access
  • Privileged administrator access without public bastions
  • Contractor access to narrowly scoped private applications

Replaces self-managed remote-access VPN concentrators, while identity and certificate governance, endpoint routing, client security, DNS, logging, authorization review, and downstream application access remain yours.

Official implementation resources

Commonly paired AWS services