# ClientVpnEndpointOptions

Options for a client VPN endpoint.

- Source: [`aws-ec2/lib/client-vpn-endpoint.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-ec2/lib/client-vpn-endpoint.ts#L45)
- Type last changed: v2.235.0 · 15 Jan 2026

## Example

```ts
vpc.addClientVpnEndpoint('Endpoint', {
  cidr: '10.100.0.0/16',
  serverCertificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/server-certificate-id',
  // Mutual authentication
  clientCertificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/client-certificate-id',
  // User-based authentication
  userBasedAuthentication: ec2.ClientVpnUserBasedAuthentication.federated(samlProvider),
});
```

## Properties

- `authorizeAllUsersToVpcCidr`: boolean = true — Whether to authorize all users to the VPC CIDR.

  This automatically creates an authorization rule. Set this to `false` and
  use `addAuthorizationRule()` to create your own rules instead.

- `cidr`: string (required) — The IPv4 address range, in CIDR notation, from which to assign client IP addresses.

  The address range cannot overlap with the local CIDR of the VPC
  in which the associated subnet is located, or the routes that you add manually.

  Changing the address range will replace the Client VPN endpoint.

  The CIDR block should be /22 or greater.

- `clientCertificateArn`: string — The ARN of the client certificate for mutual authentication.

  **Default:** use user-based authentication

  The certificate must be signed by a certificate authority (CA) and it must
  be provisioned in AWS Certificate Manager (ACM).

- `clientConnectionHandler`: [IClientVpnConnectionHandler](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IClientVpnConnectionHandler.html) — The AWS Lambda function used for connection authorization.

  **Default:** no connection handler

  The name of the Lambda function must begin with the `AWSClientVPN-` prefix

- `clientLoginBanner`: string — Customizable text that will be displayed in a banner on AWS provided clients when a VPN session is established.

  **Default:** no banner is presented to the client

  UTF-8 encoded characters only. Maximum of 1400 characters.

- `clientRouteEnforcementOptions`: [ClientRouteEnforcementOptions](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ClientRouteEnforcementOptions.html) — Options for Client Route Enforcement.

  **Default:** undefined - AWS Client VPN default setting is disable client route enforcement

  Client Route Enforcement is a feature of Client VPN that helps enforce administrator defined routes on devices connected through the VPN.
  This feature helps improve your security posture by ensuring that network traffic originating from a connected client is not inadvertently sent outside the VPN tunnel.

- `description`: string — A brief description of the Client VPN endpoint.

  **Default:** no description

- `disconnectOnSessionTimeout`: boolean — Indicates whether the client VPN session is disconnected after the maximum `sessionTimeout` is reached.

  **Default:** undefined - AWS Client VPN default is true

  If `true`, users are prompted to reconnect client VPN.
  If `false`, client VPN attempts to reconnect automatically.

- `dnsServers`: string[] — Information about the DNS servers to be used for DNS resolution.

  **Default:** use the DNS address configured on the device

  A Client VPN endpoint can have up to two DNS servers.

- `logging`: boolean = true — Whether to enable connections logging.

- `logGroup`: [ILogGroupRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_logs.ILogGroupRef.html) — A CloudWatch Logs log group for connection logging.

  **Default:** a new group is created

- `logStream`: [ILogStreamRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_logs.ILogStreamRef.html) — A CloudWatch Logs log stream for connection logging.

  **Default:** a new stream is created

- `port`: [VpnPort](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.VpnPort.html) = VpnPort.HTTPS — The port number to assign to the Client VPN endpoint for TCP and UDP traffic.

- `securityGroups`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html)[] — The security groups to apply to the target network.

  **Default:** a new security group is created

- `selfServicePortal`: boolean = true — Specify whether to enable the self-service portal for the Client VPN endpoint.

- `serverCertificateArn`: string (required) — The ARN of the server certificate.

- `sessionTimeout`: [ClientVpnSessionTimeout](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ClientVpnSessionTimeout.html) — The maximum VPN session duration time.

  **Default:** ClientVpnSessionTimeout.TWENTY_FOUR_HOURS

- `splitTunnel`: boolean = false — Indicates whether split-tunnel is enabled on the AWS Client VPN endpoint.

- `transportProtocol`: [TransportProtocol](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.TransportProtocol.html) = TransportProtocol.UDP — The transport protocol to be used by the VPN session.

- `userBasedAuthentication`: [ClientVpnUserBasedAuthentication](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ClientVpnUserBasedAuthentication.html) — The type of user-based authentication to use.

  **Default:** use mutual authentication

- `vpcSubnets`: [SubnetSelection](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetSelection.html) — Subnets to associate to the client VPN endpoint.

  **Default:** the VPC default strategy