ClientVpnEndpointOptions Struct
Options for a client VPN endpoint.
Example
vpc.addClientVpnEndpoint('Endpoint', {
cidr: '10.100.0.0/16',
serverCertificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/server-certificate-id',
// Mutual authentication
clientCertificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/client-certificate-id',
// User-based authentication
userBasedAuthentication: ec2.ClientVpnUserBasedAuthentication.federated(samlProvider),
});
Properties
authorizeAllUsersToVpcCidrbooleanauthorize_all_users_to_vpc_cidrboolauthorizeAllUsersToVpcCidrBooleanAuthorizeAllUsersToVpcCidrboolAuthorizeAllUsersToVpcCidr*bool= true#This automatically creates an authorization rule. Set this to false and use addAuthorizationRule() to create your own rules instead.
notes
The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually.
Changing the address range will replace the Client VPN endpoint.
The CIDR block should be /22 or greater.
clientCertificateArnstringclient_certificate_arnstrclientCertificateArnStringClientCertificateArnstringClientCertificateArn*string#Default: use user-based authentication
The certificate must be signed by a certificate authority (CA) and it must be provisioned in AWS Certificate Manager (ACM).
clientConnectionHandlerIClientVpnConnectionHandlerclient_connection_handlerIClientVpnConnectionHandlerclientConnectionHandlerIClientVpnConnectionHandlerClientConnectionHandlerIClientVpnConnectionHandlerClientConnectionHandlerIClientVpnConnectionHandler#Default: no connection handler
The name of the Lambda function must begin with the AWSClientVPN- prefix
clientLoginBannerstringclient_login_bannerstrclientLoginBannerStringClientLoginBannerstringClientLoginBanner*string#Default: no banner is presented to the client
UTF-8 encoded characters only. Maximum of 1400 characters.
clientRouteEnforcementOptionsClientRouteEnforcementOptionsclient_route_enforcement_optionsClientRouteEnforcementOptionsclientRouteEnforcementOptionsClientRouteEnforcementOptionsClientRouteEnforcementOptionsClientRouteEnforcementOptionsClientRouteEnforcementOptionsClientRouteEnforcementOptions#Default: undefined - AWS Client VPN default setting is disable client route enforcement
notes
Client Route Enforcement is a feature of Client VPN that helps enforce administrator defined routes on devices connected through the VPN. This feature helps improve your security posture by ensuring that network traffic originating from a connected client is not inadvertently sent outside the VPN tunnel.
Default: no description
disconnectOnSessionTimeoutbooleandisconnect_on_session_timeoutbooldisconnectOnSessionTimeoutBooleanDisconnectOnSessionTimeoutboolDisconnectOnSessionTimeout*bool#Default: undefined - AWS Client VPN default is true
If true, users are prompted to reconnect client VPN. If false, client VPN attempts to reconnect automatically.
dnsServersstring[]dns_serverstyping.List[str]dnsServersList<String>DnsServersstring[]DnsServers*[]*string#Default: use the DNS address configured on the device
A Client VPN endpoint can have up to two DNS servers.
logGroupILogGroupReflog_groupILogGroupReflogGroupILogGroupRefLogGroupILogGroupRefLogGroupILogGroupRef#Default: a new group is created
logStreamILogStreamReflog_streamILogStreamReflogStreamILogStreamRefLogStreamILogStreamRefLogStreamILogStreamRef#Default: a new stream is created
securityGroupsISecurityGroup[]security_groupstyping.List[ISecurityGroup]securityGroupsList<ISecurityGroup>SecurityGroupsISecurityGroup[]SecurityGroups*[]ISecurityGroup#Default: a new security group is created
selfServicePortalbooleanself_service_portalboolselfServicePortalBooleanSelfServicePortalboolSelfServicePortal*bool= true#serverCertificateArnstringserver_certificate_arnstrserverCertificateArnStringServerCertificateArnstringServerCertificateArn*stringrequired#sessionTimeoutClientVpnSessionTimeoutsession_timeoutClientVpnSessionTimeoutsessionTimeoutClientVpnSessionTimeoutSessionTimeoutClientVpnSessionTimeoutSessionTimeoutClientVpnSessionTimeout#Default: ClientVpnSessionTimeout.TWENTY_FOUR_HOURS
transportProtocolTransportProtocoltransport_protocolTransportProtocoltransportProtocolTransportProtocolTransportProtocolTransportProtocolTransportProtocolTransportProtocol= TransportProtocol.UDP#userBasedAuthenticationClientVpnUserBasedAuthenticationuser_based_authenticationClientVpnUserBasedAuthenticationuserBasedAuthenticationClientVpnUserBasedAuthenticationUserBasedAuthenticationClientVpnUserBasedAuthenticationUserBasedAuthenticationClientVpnUserBasedAuthentication#Default: use mutual authentication
vpcSubnetsSubnetSelectionvpc_subnetsSubnetSelectionvpcSubnetsSubnetSelectionVpcSubnetsSubnetSelectionVpcSubnetsSubnetSelection#Default: the VPC default strategy