{"id":29354309,"url":"https://github.com/pete911/aws-vpn","last_synced_at":"2026-05-16T22:35:07.913Z","repository":{"id":302787320,"uuid":"1013378055","full_name":"pete911/aws-vpn","owner":"pete911","description":"cli to create VPN on AWS","archived":false,"fork":false,"pushed_at":"2026-05-05T06:54:21.000Z","size":340,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-05-05T08:34:08.100Z","etag":null,"topics":["aws","go","golang","openvpn","openvpn-server","vpn","vpn-server"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pete911.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-07-03T19:53:59.000Z","updated_at":"2026-05-05T06:54:22.000Z","dependencies_parsed_at":null,"dependency_job_id":"29eb3428-bdfb-4b31-baae-5483b7b2137d","html_url":"https://github.com/pete911/aws-vpn","commit_stats":null,"previous_names":["pete911/aws-vpn"],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/pete911/aws-vpn","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pete911%2Faws-vpn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pete911%2Faws-vpn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pete911%2Faws-vpn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pete911%2Faws-vpn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pete911","download_url":"https://codeload.github.com/pete911/aws-vpn/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pete911%2Faws-vpn/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33121291,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-16T18:38:32.183Z","status":"ssl_error","status_checked_at":"2026-05-16T18:38:29.903Z","response_time":115,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","go","golang","openvpn","openvpn-server","vpn","vpn-server"],"created_at":"2025-07-09T03:13:00.806Z","updated_at":"2026-05-16T22:35:07.907Z","avatar_url":"https://github.com/pete911.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws-vpn\n\nCurrently only OpenVPN is supported. Project creates t3a.nano EC2 instance with amazon linux 2023 (x86_64 architecture).\n[User data](internal/vpn/ovpn/tmpl.go) is executed and VPN is configured. All secrets (certificates and keys) are stored\nin secrets manager. Security groups are configured to allow only users (whoever runs the cli) IP. This can be overridden\nwith `--inbound-cidr` flag if needed, when creating VPN.\n\n```\n                 ┌──────────┐                            \n                 │          │                            \n        ┌────────► Secrets  │                            \n        │        │ Manager  │                            \n        │        └──────────┘                            \n   ┌────┴────┐   ┌──────────┐                            \n   │         │   │          │                            \n   │   EC2   ┼───► Security │                            \n   │  (VPN)  │   │ Group    │                            \n   └────┬────┘   └──────────┘                            \n        │        ┌──────────┐  ┌──────────┐              \n        │        │          │  │          │              \n        └────────► Instance ┼──► IAM role │              \n                 │ Profile  │  │          │              \n                 └──────────┘  └──────────┘              \n```\n\n## pre-requisites\n\nAWS account has to have default VPC with access to internet. To keep this project simple (and cost-effective), it does\nnot create VPC (IGW and/or NAT gateways), but re-uses existing default VPC.\n\n## usage\n\n### build/install\n\nYou can either build from source, or install. Pick any of the options:\n- build `go build` (or use `Taskfile.yml` - `task` command)\n- [download binary](https://github.com/pete911/aws-vpn/releases)\n- install via brew\n  - add tap `brew tap pete911/tap`\n  - install `brew install aws-vpn`\n\n### run\n\nIf you have more than one AWS account, you can use different profile by prefixing commands with `AWS_PROFILE=\u003cprofiel\u003e \u003ccmd\u003e`\n- create VPN `aws-vpn create \u003cname\u003e` (name has to be unique per region)\n  - you can either select region via `--region` flag, otherwise prompt with select is presented\n- get client config `aws-vpn config` (either select region, or provide `--region` flag)\n- start [openvpn client](https://openvpn.net/client/)\n- import profile (click plus sign at the bottom right)\n  - select \"upload file\" and select file `\u003cregion\u003e-aws-vpn-\u003cname\u003e.ovpn` from home directory\n  - connect\n- delete VPN `aws-vpn delete` (same as with other commands, region can be provided via `--region` flag)\n \n## releases\n\nReleases are published when the new tag is created e.g. `git tag -m \"add some feature\" v0.0.1 \u0026\u0026 git push --follow-tags`\n\n## debug\n\n### cleanup failures\n\nIn case when cleanup/delete fails:\n- check if instance was deleted\n- after the instance is deleted, check and delete security group\n- check and delete (if needed) instance profile (replace `\u003cname\u003e`) and role\n    - `aws iam get-instance-profile --instance-profile-name aws-vpn-\u003cname\u003e`\n    - `aws iam remove-role-from-instance-profile --instance-profile-name aws-vpn-\u003cname\u003e --role-name aws-vpn-\u003cname\u003e-\u003cregion\u003e`\n    - `aws iam delete-instance-profile --instance-profile-name aws-vpn-\u003cname\u003e`\n    - `aws iam delete-role --role-name aws-vpn-\u003cname\u003e-\u003cregion\u003e`\n- check and delete secrets (replace `\u003cname\u003e`, and `...` with `client.crt`, `client.key`, `ca.crt` and `ta.key`)\n  - `aws secretsmanager delete-secret --secret-id /vpn/aws-vpn-\u003cname\u003e/secrets/... --force-delete-without-recovery`\n\n### debug on EC2 instance\n\nEC2 instance has SSH disabled, but user can connect via SSM.\n- start openvpn service `sudo systemctl start openvpn-server@server.service` \n- openvpn service status `sudo systemctl status openvpn-server@server.service`\n- logs:\n  - service `sudo journalctl -xeu openvpn-server@server.service`\n  - openvpn `sudo cat /etc/openvpn/server/openvpn-status.log`\n  - cloud init `sudo cat /var/log/cloud-init.log`\n  - cloud init output `sudo cat /var/log/cloud-init-output.log`\n  - user data `curl http://169.254.169.254/latest/user-data`\n- sample server config `/usr/share/doc/openvpn/sample/sample-config-files/server.conf`\n- sample client config `/usr/share/doc/openvpn/sample/sample-config-files/client.conf`\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpete911%2Faws-vpn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpete911%2Faws-vpn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpete911%2Faws-vpn/lists"}