{"id":18535703,"url":"https://github.com/fivexl/terraform-aws-client-vpn-endpoint","last_synced_at":"2025-04-09T15:32:41.760Z","repository":{"id":41869679,"uuid":"385928608","full_name":"fivexl/terraform-aws-client-vpn-endpoint","owner":"fivexl","description":"AWS Client VPN endpoint","archived":false,"fork":false,"pushed_at":"2025-01-20T11:14:41.000Z","size":55,"stargazers_count":9,"open_issues_count":16,"forks_count":8,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-24T08:54:41.577Z","etag":null,"topics":["aws","terraform","terraform-module","terraform-modules"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/fivexl/client-vpn-endpoint/aws/latest","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fivexl.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-07-14T12:14:32.000Z","updated_at":"2025-01-20T16:25:48.000Z","dependencies_parsed_at":"2022-08-27T19:41:54.731Z","dependency_job_id":"d0737286-9ce1-4242-995e-3110f8bc0908","html_url":"https://github.com/fivexl/terraform-aws-client-vpn-endpoint","commit_stats":null,"previous_names":[],"tags_count":13,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fivexl%2Fterraform-aws-client-vpn-endpoint","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fivexl%2Fterraform-aws-client-vpn-endpoint/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fivexl%2Fterraform-aws-client-vpn-endpoint/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fivexl%2Fterraform-aws-client-vpn-endpoint/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fivexl","download_url":"https://codeload.github.com/fivexl/terraform-aws-client-vpn-endpoint/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248058180,"owners_count":21040712,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","terraform","terraform-module","terraform-modules"],"created_at":"2024-11-06T19:26:45.295Z","updated_at":"2025-04-09T15:32:41.753Z","avatar_url":"https://github.com/fivexl.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform-aws-client-vpn-endpoint\nAWS Client VPN endpoint\n\n## Info\n- [AWS Client VPN pricing](https://aws.amazon.com/vpn/pricing/)\n\n## How to create Application for VPN in AWS Single Sign-On\n- Open AWS SSO service page. Select Applications from the sidebar\n- Choose Add a new application\n- Select Add a custom SAML 2.0 application\n- Fill Display name and Description\n- Set session duration (VPN session duration) - 12h\n- Select \"If you don't have a metadata file, you can manually type your metadata values.\"\n- Application ACS URL: http://127.0.0.1:35001\n- Application SAML audience: urn:amazon:webservices:clientvpn\n- Save changes\n- Download AWS SSO SAML metadata file (file for vpn secret)\n- Select tab \"Attribute mappings\":\n    - Subject -\u003e ${user:subject} -\u003e emailAddress\n    - NameID -\u003e ${user:email} -\u003e basic\n    - memberOf -\u003e ${user:groups} -\u003e unspecified\n- Select tab \"Assigned users\"\n- Assign users or groups created on previous step\n\n## Example\n\n```hcl \n\n# Get metadata.xml file from AWS SSO/Applications\n# Encode file with base64 `base64 -w 0` (linux only) or `openssl base64 -A`\n# Create secret `saml_metadata` with key `saml_metadata_xml` and value base64\n\ndata \"aws_secretsmanager_secret\" \"saml\" {\n  name = \"saml_metadata\"\n}\n\ndata \"aws_secretsmanager_secret_version\" \"saml\" {\n  secret_id     = data.aws_secretsmanager_secret.saml.id\n  version_stage = \"AWSCURRENT\"\n}\n\nresource \"aws_iam_saml_provider\" \"vpn\" {\n  name                   = var.vpn_saml_provider_name # could be anything that satisfy regular expression pattern: [\\w._-]+ \n  saml_metadata_document = base64decode(jsondecode(data.aws_secretsmanager_secret_version.saml.secret_string)[\"saml_metadata_xml\"]) # saml_metadata_xml\n  tags                   = var.tags\n}\n\nmodule \"vpn\" {\n  source                     = \"fivexl/client-vpn-endpoint/aws\"\n  endpoint_name              = \"myvpn\"\n  endpoint_client_cidr_block = \"10.100.0.0/16\"\n  endpoint_subnets           = [module.vpc.intra_subnets[0]] # Attach VPN to single subnet. Reduce cost\n  endpoint_vpc_id            = module.vpc.vpc_id\n  tls_subject_common_name    = \"int.example.com\"\n  saml_provider_arn          = aws_iam_saml_provider.vpn.arn\n\n  authorization_rules = {}\n\n  additional_routes = {\n    \"${module.vpc.intra_subnets[0]}\" = \"172.16.0.0/24\"\n  }\n\n  authorization_rules_all_groups = {\n    full_access_private_subnet_0 = module.vpc.private_subnets_cidr_blocks[0]\n  }\n\n  tags = var.tags\n}\n```\n\n## Example without split tunnel (classic VPN)\n\n```hcl \n\n# Get metadata.xml file from AWS SSO/Applications\n# Encode file with base64 `base64 -w 0` (linux only) or `openssl base64 -A`\n# Create secret `saml_metadata` with key `saml_metadata_xml` and value base64\n\ndata \"aws_secretsmanager_secret\" \"saml\" {\n  name = \"saml_metadata\"\n}\n\ndata \"aws_secretsmanager_secret_version\" \"saml\" {\n  secret_id     = data.aws_secretsmanager_secret.saml.id\n  version_stage = \"AWSCURRENT\"\n}\n\nresource \"aws_iam_saml_provider\" \"vpn\" {\n  name                   = var.vpn_saml_provider_name # could be anything that satisfy regular expression pattern: [\\w._-]+ \n  saml_metadata_document = base64decode(jsondecode(data.aws_secretsmanager_secret_version.saml.secret_string)[\"saml_metadata_xml\"]) # saml_metadata_xml\n  tags                   = var.tags\n}\n\nmodule \"vpn\" {\n  source                     = \"fivexl/client-vpn-endpoint/aws\"\n  endpoint_name              = \"myvpn\"\n  endpoint_client_cidr_block = \"10.100.0.0/16\"\n  endpoint_subnets           = [module.vpc.private_subnets[0]] # Attach VPN to single subnet. Reduce cost\n  endpoint_vpc_id            = module.vpc.vpc_id\n  tls_subject_common_name    = \"int.example.com\"\n  saml_provider_arn          = aws_iam_saml_provider.vpn.arn\n\n  authorization_rules = {}\n\n  additional_routes = {\n    \"${module.vpc.private_subnets[0]}\" = \"0.0.0.0/0\"\n  }\n\n  authorization_rules_all_groups = {\n    worldwide = \"0.0.0.0/0\"\n  }\n  \n  enable_split_tunnel = false\n\n  tags = var.tags\n}\n```\n\n## Example with VPC module\n```hcl\nvariable \"vpn_access_public\" {\n  description = \"List of SSO Group IDs for accessing public subnets\"\n  type        = list(string)\n  default     = []\n}\n\nvariable \"vpn_access_private\" {\n  description = \"List of SSO Group IDs for accessing private subnets\"\n  type        = list(string)\n  default     = []\n}\n\nvariable \"vpn_access_intra\" {\n  description = \"List of SSO Group IDs for accessing intra subnets\"\n  type        = list(string)\n  default     = []\n}\n\nvariable \"vpn_access_db\" {\n  description = \"List of SSO Group IDs for accessing db subnets\"\n  type        = list(string)\n  default     = []\n}\n\nvariable \"vpn_access_elasticache\" {\n  description = \"List of SSO Group IDs for accessing elasticache subnets\"\n  type        = list(string)\n  default     = []\n}\n\nvariable \"vpn_access_all\" {\n  description = \"List of SSO Group IDs for accessing all subnets\"\n  type        = list(string)\n  default     = []\n}\n\n# https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/limits.html\n# Authorization rules per Client VPN endpoint defaul quota is 50\n# https://console.aws.amazon.com/servicequotas/home/services/ec2/quotas/L-9A1BC94B\nlocals {\n  vpn_authorization_rules_public      = { for item in setproduct(module.vpc.public_subnets_cidr_blocks, var.vpn_access_public) : \"public_${item[0]}_${item[1]}\" =\u003e \"${item[0]},${item[1]}\" }\n  vpn_authorization_rules_private     = { for item in setproduct(module.vpc.private_subnets_cidr_blocks, var.vpn_access_private) : \"private_${item[0]}_${item[1]}\" =\u003e \"${item[0]},${item[1]}\" }\n  vpn_authorization_rules_intra       = { for item in setproduct(module.vpc.intra_subnets_cidr_blocks, var.vpn_access_intra) : \"intra_${item[0]}_${item[1]}\" =\u003e \"${item[0]},${item[1]}\" }\n  vpn_authorization_rules_db          = { for item in setproduct(module.vpc.database_subnets_cidr_blocks, var.vpn_access_db) : \"db_${item[0]}_${item[1]}\" =\u003e \"${item[0]},${item[1]}\" }\n  vpn_authorization_rules_elasticache = { for item in setproduct(module.vpc.elasticache_subnets_cidr_blocks, var.vpn_access_elasticache) : \"elasticache_${item[0]}_${item[1]}\" =\u003e \"${item[0]},${item[1]}\" }\n  vpn_authorization_rules_all         = { for item in setproduct([module.vpc.vpc_cidr_block], var.vpn_access_all) : \"all_${item[0]}_${item[1]}\" =\u003e \"${item[0]},${item[1]}\" }\n  vpn_authorization_rules = merge(\n    local.vpn_authorization_rules_public,\n    local.vpn_authorization_rules_private,\n    local.vpn_authorization_rules_intra,\n    local.vpn_authorization_rules_db,\n    local.vpn_authorization_rules_elasticache,\n    local.vpn_authorization_rules_all\n  )\n}\n\nmodule \"vpn\" {\n  source                     = \"fivexl/client-vpn-endpoint/aws\"\n  endpoint_name              = \"myvpn\"\n  endpoint_client_cidr_block = \"10.100.0.0/16\"\n  endpoint_subnets           = [module.vpc.intra_subnets[0]] # Attach VPN to single subnet. Reduce cost\n  endpoint_vpc_id            = module.vpc.vpc_id\n  tls_subject_common_name    = \"int.example.com\"\n  saml_provider_arn          = data.aws_ssm_parameter.iam_vpn_saml_provider_arn.value\n\n  authorization_rules = local.vpn_authorization_rules\n\n  authorization_rules_all_groups = {}\n\n  tags = var.tags\n}\n```\n\n\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 0.15 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 4.0 |\n| \u003ca name=\"requirement_tls\"\u003e\u003c/a\u003e [tls](#requirement\\_tls) | \u003e= 3.2.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 4.0 |\n| \u003ca name=\"provider_tls\"\u003e\u003c/a\u003e [tls](#provider\\_tls) | \u003e= 3.2.0 |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_acm_certificate.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate) | resource |\n| [aws_cloudwatch_log_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |\n| [aws_cloudwatch_log_stream.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_stream) | resource |\n| [aws_ec2_client_vpn_authorization_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_authorization_rule) | resource |\n| [aws_ec2_client_vpn_authorization_rule.this_all_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_authorization_rule) | resource |\n| [aws_ec2_client_vpn_authorization_rule.this_sso_to_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_authorization_rule) | resource |\n| [aws_ec2_client_vpn_endpoint.this_sso](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_endpoint) | resource |\n| [aws_ec2_client_vpn_network_association.this_sso](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_network_association) | resource |\n| [aws_ec2_client_vpn_route.this_sso](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_route) | resource |\n| [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |\n| [tls_private_key.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |\n| [tls_self_signed_cert.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/self_signed_cert) | resource |\n| [aws_vpc.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_additional_routes\"\u003e\u003c/a\u003e [additional\\_routes](#input\\_additional\\_routes) | A list of maps where each map contains a subnet ID of endpoint subnet for network association and a list of cidrs to where traffic should be routed from that subnet. Useful in cases if you need to route beyond the VPC subnet, for instance peered VPC | `list(map(string))` | `{}` | no |\n| \u003ca name=\"input_authorization_rules\"\u003e\u003c/a\u003e [authorization\\_rules](#input\\_authorization\\_rules) | Map containing authorization rule configuration. rule\\_name = \"target\\_network\\_cidr, access\\_group\\_id\" . | `map(string)` | `{}` | no |\n| \u003ca name=\"input_authorization_rules_all_groups\"\u003e\u003c/a\u003e [authorization\\_rules\\_all\\_groups](#input\\_authorization\\_rules\\_all\\_groups) | Map containing authorization rule configuration with authorize\\_all\\_groups=true. rule\\_name = \"target\\_network\\_cidr\" . | `map(string)` | `{}` | no |\n| \u003ca name=\"input_certificate_arn\"\u003e\u003c/a\u003e [certificate\\_arn](#input\\_certificate\\_arn) | The ARN of ACM certigicate to use for the VPN server config. | `string` | `null` | no |\n| \u003ca name=\"input_cloudwatch_log_group_name_prefix\"\u003e\u003c/a\u003e [cloudwatch\\_log\\_group\\_name\\_prefix](#input\\_cloudwatch\\_log\\_group\\_name\\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs. | `string` | `\"/aws/client-vpn-endpoint/\"` | no |\n| \u003ca name=\"input_cloudwatch_log_group_retention_in_days\"\u003e\u003c/a\u003e [cloudwatch\\_log\\_group\\_retention\\_in\\_days](#input\\_cloudwatch\\_log\\_group\\_retention\\_in\\_days) | Specifies the number of days you want to retain log events in the specified log group for VPN connection logs. | `number` | `30` | no |\n| \u003ca name=\"input_create_endpoint\"\u003e\u003c/a\u003e [create\\_endpoint](#input\\_create\\_endpoint) | Create Client VPN Endpoint | `bool` | `true` | no |\n| \u003ca name=\"input_dns_servers\"\u003e\u003c/a\u003e [dns\\_servers](#input\\_dns\\_servers) | DNS servers to be used for DNS resolution. A Client VPN endpoint can have up to two DNS servers. If no DNS server is specified, the DNS address of the connecting device is used. Conflict with `use_vpc_internal_dns` | `list(string)` | `[]` | no |\n| \u003ca name=\"input_enable_split_tunnel\"\u003e\u003c/a\u003e [enable\\_split\\_tunnel](#input\\_enable\\_split\\_tunnel) | Indicates whether split-tunnel is enabled on VPN endpoint | `bool` | `true` | no |\n| \u003ca name=\"input_endpoint_client_cidr_block\"\u003e\u003c/a\u003e [endpoint\\_client\\_cidr\\_block](#input\\_endpoint\\_client\\_cidr\\_block) | The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater. | `string` | `\"10.100.100.0/24\"` | no |\n| \u003ca name=\"input_endpoint_name\"\u003e\u003c/a\u003e [endpoint\\_name](#input\\_endpoint\\_name) | Name to be used on the Client VPN Endpoint | `string` | n/a | yes |\n| \u003ca name=\"input_endpoint_subnets\"\u003e\u003c/a\u003e [endpoint\\_subnets](#input\\_endpoint\\_subnets) | List of IDs of endpoint subnets for network association | `list(string)` | n/a | yes |\n| \u003ca name=\"input_endpoint_vpc_id\"\u003e\u003c/a\u003e [endpoint\\_vpc\\_id](#input\\_endpoint\\_vpc\\_id) | VPC where the VPN will be connected. | `string` | n/a | yes |\n| \u003ca name=\"input_saml_provider_arn\"\u003e\u003c/a\u003e [saml\\_provider\\_arn](#input\\_saml\\_provider\\_arn) | The ARN of the IAM SAML identity provider. | `string` | n/a | yes |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |\n| \u003ca name=\"input_tls_subject_common_name\"\u003e\u003c/a\u003e [tls\\_subject\\_common\\_name](#input\\_tls\\_subject\\_common\\_name) | The common\\_name for subject for which a certificate is being requested. RFC5280. Not used if certificate\\_arn provided. | `string` | `\"vpn.example.com\"` | no |\n| \u003ca name=\"input_tls_validity_period_hours\"\u003e\u003c/a\u003e [tls\\_validity\\_period\\_hours](#input\\_tls\\_validity\\_period\\_hours) | Specifies the number of hours after initial issuing that the certificate will become invalid.  Not used if certificate\\_arn provided. | `number` | `47400` | no |\n| \u003ca name=\"input_transport_protocol\"\u003e\u003c/a\u003e [transport\\_protocol](#input\\_transport\\_protocol) | The transport protocol to be used by the VPN session. | `string` | `\"udp\"` | no |\n| \u003ca name=\"input_use_vpc_internal_dns\"\u003e\u003c/a\u003e [use\\_vpc\\_internal\\_dns](#input\\_use\\_vpc\\_internal\\_dns) | Use VPC Internal DNS as is DNS servers | `bool` | `true` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_ec2_client_vpn_endpoint_arn\"\u003e\u003c/a\u003e [ec2\\_client\\_vpn\\_endpoint\\_arn](#output\\_ec2\\_client\\_vpn\\_endpoint\\_arn) | The ARN of the Client VPN endpoint |\n| \u003ca name=\"output_ec2_client_vpn_endpoint_id\"\u003e\u003c/a\u003e [ec2\\_client\\_vpn\\_endpoint\\_id](#output\\_ec2\\_client\\_vpn\\_endpoint\\_id) | The ID of the Client VPN endpoint |\n| \u003ca name=\"output_ec2_client_vpn_network_associations\"\u003e\u003c/a\u003e [ec2\\_client\\_vpn\\_network\\_associations](#output\\_ec2\\_client\\_vpn\\_network\\_associations) | Network associations for AWS Client VPN endpoint |\n| \u003ca name=\"output_security_group_description\"\u003e\u003c/a\u003e [security\\_group\\_description](#output\\_security\\_group\\_description) | Security group description |\n| \u003ca name=\"output_security_group_id\"\u003e\u003c/a\u003e [security\\_group\\_id](#output\\_security\\_group\\_id) | A map of tags to add to all resources |\n| \u003ca name=\"output_security_group_name\"\u003e\u003c/a\u003e [security\\_group\\_name](#output\\_security\\_group\\_name) | Name of the security group |\n| \u003ca name=\"output_security_group_vpc_id\"\u003e\u003c/a\u003e [security\\_group\\_vpc\\_id](#output\\_security\\_group\\_vpc\\_id) | VPC ID |\n\u003c!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffivexl%2Fterraform-aws-client-vpn-endpoint","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffivexl%2Fterraform-aws-client-vpn-endpoint","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffivexl%2Fterraform-aws-client-vpn-endpoint/lists"}