AWS Client VPN
VPN for remote users
A managed client-to-site VPN service (based on OpenVPN) for employees to connect securely from laptops to VPCs and on-prem networks; authentication via certificates, Active Directory or SAML.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsSAA · SOA
Think of it asLike a personal access badge that lets remote employees still get into the office.
When to use it
✓ Use it when
Remote employees need access to private resources in a VPC.
✗ Avoid it when
Connecting an entire office/data center to AWS → Site-to-Site VPN; access to web applications without a VPN → Verified Access.
Common uses
- Remote employees accessing a private database
- Developers SSHing into EC2 in private subnets
- Accessing on-prem systems through the VPC
What does it cost?
- Pricing model: Charged hourly for each endpoint subnet association plus connection hours for each client.
⚠️ Cost traps
Forgetting to remove subnet associations means you're still charged even when nobody connects.
Related services
SAA-C03 study guide
Client VPN is covered in these study modules: