https://github.com/fivexl/terraform-aws-client-vpn-endpoint

AWS Client VPN endpoint
https://github.com/fivexl/terraform-aws-client-vpn-endpoint
aws terraform terraform-module terraform-modules
Last synced: about 1 year ago
JSON representation
AWS Client VPN endpoint
Host: GitHub
URL: https://github.com/fivexl/terraform-aws-client-vpn-endpoint
Owner: fivexl
License: apache-2.0
Created: 2021-07-14T12:14:32.000Z (almost 5 years ago)
Default Branch: master
Last Pushed: 2025-01-20T11:14:41.000Z (over 1 year ago)
Last Synced: 2025-03-24T08:54:41.577Z (over 1 year ago)
Topics: aws, terraform, terraform-module, terraform-modules
Language: HCL
Homepage: https://registry.terraform.io/modules/fivexl/client-vpn-endpoint/aws/latest
Size: 53.7 KB
Stars: 9
Watchers: 1
Forks: 8
Open Issues: 16
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project

README

          # terraform-aws-client-vpn-endpoint

AWS Client VPN endpoint

## Info

- [AWS Client VPN pricing](https://aws.amazon.com/vpn/pricing/)

## How to create Application for VPN in AWS Single Sign-On

- Open AWS SSO service page. Select Applications from the sidebar

- Choose Add a new application

- Select Add a custom SAML 2.0 application

- Fill Display name and Description

- Set session duration (VPN session duration) - 12h

- Select "If you don't have a metadata file, you can manually type your metadata values."

- Application ACS URL: http://127.0.0.1:35001

- Application SAML audience: urn:amazon:webservices:clientvpn

- Save changes

- Download AWS SSO SAML metadata file (file for vpn secret)

- Select tab "Attribute mappings":

    - Subject -> ${user:subject} -> emailAddress

    - NameID -> ${user:email} -> basic

    - memberOf -> ${user:groups} -> unspecified

- Select tab "Assigned users"

- Assign users or groups created on previous step

## Example

```hcl 

# Get metadata.xml file from AWS SSO/Applications

# Encode file with base64 `base64 -w 0` (linux only) or `openssl base64 -A`

# Create secret `saml_metadata` with key `saml_metadata_xml` and value base64

data "aws_secretsmanager_secret" "saml" {

  name = "saml_metadata"

}

data "aws_secretsmanager_secret_version" "saml" {

  secret_id     = data.aws_secretsmanager_secret.saml.id

  version_stage = "AWSCURRENT"

}

resource "aws_iam_saml_provider" "vpn" {

  name                   = var.vpn_saml_provider_name # could be anything that satisfy regular expression pattern: [\w._-]+ 

  saml_metadata_document = base64decode(jsondecode(data.aws_secretsmanager_secret_version.saml.secret_string)["saml_metadata_xml"]) # saml_metadata_xml

  tags                   = var.tags

}

module "vpn" {

  source                     = "fivexl/client-vpn-endpoint/aws"

  endpoint_name              = "myvpn"

  endpoint_client_cidr_block = "10.100.0.0/16"

  endpoint_subnets           = [module.vpc.intra_subnets[0]] # Attach VPN to single subnet. Reduce cost

  endpoint_vpc_id            = module.vpc.vpc_id

  tls_subject_common_name    = "int.example.com"

  saml_provider_arn          = aws_iam_saml_provider.vpn.arn

  authorization_rules = {}

  additional_routes = {

    "${module.vpc.intra_subnets[0]}" = "172.16.0.0/24"

  }

  authorization_rules_all_groups = {

    full_access_private_subnet_0 = module.vpc.private_subnets_cidr_blocks[0]

  }

  tags = var.tags

}

```

## Example without split tunnel (classic VPN)

```hcl 

# Get metadata.xml file from AWS SSO/Applications

# Encode file with base64 `base64 -w 0` (linux only) or `openssl base64 -A`

# Create secret `saml_metadata` with key `saml_metadata_xml` and value base64

data "aws_secretsmanager_secret" "saml" {

  name = "saml_metadata"

}

data "aws_secretsmanager_secret_version" "saml" {

  secret_id     = data.aws_secretsmanager_secret.saml.id

  version_stage = "AWSCURRENT"

}

resource "aws_iam_saml_provider" "vpn" {

  name                   = var.vpn_saml_provider_name # could be anything that satisfy regular expression pattern: [\w._-]+ 

  saml_metadata_document = base64decode(jsondecode(data.aws_secretsmanager_secret_version.saml.secret_string)["saml_metadata_xml"]) # saml_metadata_xml

  tags                   = var.tags

}

module "vpn" {

  source                     = "fivexl/client-vpn-endpoint/aws"

  endpoint_name              = "myvpn"

  endpoint_client_cidr_block = "10.100.0.0/16"

  endpoint_subnets           = [module.vpc.private_subnets[0]] # Attach VPN to single subnet. Reduce cost

  endpoint_vpc_id            = module.vpc.vpc_id

  tls_subject_common_name    = "int.example.com"

  saml_provider_arn          = aws_iam_saml_provider.vpn.arn

  authorization_rules = {}

  additional_routes = {

    "${module.vpc.private_subnets[0]}" = "0.0.0.0/0"

  }

  authorization_rules_all_groups = {

    worldwide = "0.0.0.0/0"

  }

  

  enable_split_tunnel = false

  tags = var.tags

}

```

## Example with VPC module

```hcl

variable "vpn_access_public" {

  description = "List of SSO Group IDs for accessing public subnets"

  type        = list(string)

  default     = []

}

variable "vpn_access_private" {

  description = "List of SSO Group IDs for accessing private subnets"

  type        = list(string)

  default     = []

}

variable "vpn_access_intra" {

  description = "List of SSO Group IDs for accessing intra subnets"

  type        = list(string)

  default     = []

}

variable "vpn_access_db" {

  description = "List of SSO Group IDs for accessing db subnets"

  type        = list(string)

  default     = []

}

variable "vpn_access_elasticache" {

  description = "List of SSO Group IDs for accessing elasticache subnets"

  type        = list(string)

  default     = []

}

variable "vpn_access_all" {

  description = "List of SSO Group IDs for accessing all subnets"

  type        = list(string)

  default     = []

}

# https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/limits.html

# Authorization rules per Client VPN endpoint defaul quota is 50

# https://console.aws.amazon.com/servicequotas/home/services/ec2/quotas/L-9A1BC94B

locals {

  vpn_authorization_rules_public      = { for item in setproduct(module.vpc.public_subnets_cidr_blocks, var.vpn_access_public) : "public_${item[0]}_${item[1]}" => "${item[0]},${item[1]}" }

  vpn_authorization_rules_private     = { for item in setproduct(module.vpc.private_subnets_cidr_blocks, var.vpn_access_private) : "private_${item[0]}_${item[1]}" => "${item[0]},${item[1]}" }

  vpn_authorization_rules_intra       = { for item in setproduct(module.vpc.intra_subnets_cidr_blocks, var.vpn_access_intra) : "intra_${item[0]}_${item[1]}" => "${item[0]},${item[1]}" }

  vpn_authorization_rules_db          = { for item in setproduct(module.vpc.database_subnets_cidr_blocks, var.vpn_access_db) : "db_${item[0]}_${item[1]}" => "${item[0]},${item[1]}" }

  vpn_authorization_rules_elasticache = { for item in setproduct(module.vpc.elasticache_subnets_cidr_blocks, var.vpn_access_elasticache) : "elasticache_${item[0]}_${item[1]}" => "${item[0]},${item[1]}" }

  vpn_authorization_rules_all         = { for item in setproduct([module.vpc.vpc_cidr_block], var.vpn_access_all) : "all_${item[0]}_${item[1]}" => "${item[0]},${item[1]}" }

  vpn_authorization_rules = merge(

    local.vpn_authorization_rules_public,

    local.vpn_authorization_rules_private,

    local.vpn_authorization_rules_intra,

    local.vpn_authorization_rules_db,

    local.vpn_authorization_rules_elasticache,

    local.vpn_authorization_rules_all

  )

}

module "vpn" {

  source                     = "fivexl/client-vpn-endpoint/aws"

  endpoint_name              = "myvpn"

  endpoint_client_cidr_block = "10.100.0.0/16"

  endpoint_subnets           = [module.vpc.intra_subnets[0]] # Attach VPN to single subnet. Reduce cost

  endpoint_vpc_id            = module.vpc.vpc_id

  tls_subject_common_name    = "int.example.com"

  saml_provider_arn          = data.aws_ssm_parameter.iam_vpn_saml_provider_arn.value

  authorization_rules = local.vpn_authorization_rules

  authorization_rules_all_groups = {}

  tags = var.tags

}

```

## Requirements

| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | >= 0.15 |

|  [aws](#requirement\_aws) | >= 4.0 |

|  [tls](#requirement\_tls) | >= 3.2.0 |

## Providers

| Name | Version |

|------|---------|

|  [aws](#provider\_aws) | >= 4.0 |

|  [tls](#provider\_tls) | >= 3.2.0 |

## Modules

No modules.

## Resources

| Name | Type |

|------|------|

| [aws_acm_certificate.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate) | resource |

| [aws_cloudwatch_log_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |

| [aws_cloudwatch_log_stream.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_stream) | resource |

| [aws_ec2_client_vpn_authorization_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_authorization_rule) | resource |

| [aws_ec2_client_vpn_authorization_rule.this_all_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_authorization_rule) | resource |

| [aws_ec2_client_vpn_authorization_rule.this_sso_to_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_authorization_rule) | resource |

| [aws_ec2_client_vpn_endpoint.this_sso](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_endpoint) | resource |

| [aws_ec2_client_vpn_network_association.this_sso](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_network_association) | resource |

| [aws_ec2_client_vpn_route.this_sso](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_route) | resource |

| [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |

| [tls_private_key.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |

| [tls_self_signed_cert.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/self_signed_cert) | resource |

| [aws_vpc.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [additional\_routes](#input\_additional\_routes) | A list of maps where each map contains a subnet ID of endpoint subnet for network association and a list of cidrs to where traffic should be routed from that subnet. Useful in cases if you need to route beyond the VPC subnet, for instance peered VPC | `list(map(string))` | `{}` | no |

|  [authorization\_rules](#input\_authorization\_rules) | Map containing authorization rule configuration. rule\_name = "target\_network\_cidr, access\_group\_id" . | `map(string)` | `{}` | no |

|  [authorization\_rules\_all\_groups](#input\_authorization\_rules\_all\_groups) | Map containing authorization rule configuration with authorize\_all\_groups=true. rule\_name = "target\_network\_cidr" . | `map(string)` | `{}` | no |

|  [certificate\_arn](#input\_certificate\_arn) | The ARN of ACM certigicate to use for the VPN server config. | `string` | `null` | no |

|  [cloudwatch\_log\_group\_name\_prefix](#input\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs. | `string` | `"/aws/client-vpn-endpoint/"` | no |

|  [cloudwatch\_log\_group\_retention\_in\_days](#input\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPN connection logs. | `number` | `30` | no |

|  [create\_endpoint](#input\_create\_endpoint) | Create Client VPN Endpoint | `bool` | `true` | no |

|  [dns\_servers](#input\_dns\_servers) | DNS servers to be used for DNS resolution. A Client VPN endpoint can have up to two DNS servers. If no DNS server is specified, the DNS address of the connecting device is used. Conflict with `use_vpc_internal_dns` | `list(string)` | `[]` | no |

|  [enable\_split\_tunnel](#input\_enable\_split\_tunnel) | Indicates whether split-tunnel is enabled on VPN endpoint | `bool` | `true` | no |

|  [endpoint\_client\_cidr\_block](#input\_endpoint\_client\_cidr\_block) | The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater. | `string` | `"10.100.100.0/24"` | no |

|  [endpoint\_name](#input\_endpoint\_name) | Name to be used on the Client VPN Endpoint | `string` | n/a | yes |

|  [endpoint\_subnets](#input\_endpoint\_subnets) | List of IDs of endpoint subnets for network association | `list(string)` | n/a | yes |

|  [endpoint\_vpc\_id](#input\_endpoint\_vpc\_id) | VPC where the VPN will be connected. | `string` | n/a | yes |

|  [saml\_provider\_arn](#input\_saml\_provider\_arn) | The ARN of the IAM SAML identity provider. | `string` | n/a | yes |

|  [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |

|  [tls\_subject\_common\_name](#input\_tls\_subject\_common\_name) | The common\_name for subject for which a certificate is being requested. RFC5280. Not used if certificate\_arn provided. | `string` | `"vpn.example.com"` | no |

|  [tls\_validity\_period\_hours](#input\_tls\_validity\_period\_hours) | Specifies the number of hours after initial issuing that the certificate will become invalid.  Not used if certificate\_arn provided. | `number` | `47400` | no |

|  [transport\_protocol](#input\_transport\_protocol) | The transport protocol to be used by the VPN session. | `string` | `"udp"` | no |

|  [use\_vpc\_internal\_dns](#input\_use\_vpc\_internal\_dns) | Use VPC Internal DNS as is DNS servers | `bool` | `true` | no |

## Outputs

| Name | Description |

|------|-------------|

|  [ec2\_client\_vpn\_endpoint\_arn](#output\_ec2\_client\_vpn\_endpoint\_arn) | The ARN of the Client VPN endpoint |

|  [ec2\_client\_vpn\_endpoint\_id](#output\_ec2\_client\_vpn\_endpoint\_id) | The ID of the Client VPN endpoint |

|  [ec2\_client\_vpn\_network\_associations](#output\_ec2\_client\_vpn\_network\_associations) | Network associations for AWS Client VPN endpoint |

|  [security\_group\_description](#output\_security\_group\_description) | Security group description |

|  [security\_group\_id](#output\_security\_group\_id) | A map of tags to add to all resources |

|  [security\_group\_name](#output\_security\_group\_name) | Name of the security group |

|  [security\_group\_vpc\_id](#output\_security\_group\_vpc\_id) | VPC ID |
ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/fivexl/terraform-aws-client-vpn-endpoint

Awesome Lists containing this project

README
