Skip to content

Auto-generated

This page is generated by terraform-docs at build time from the infra/ repo. Do not edit manually.

Client VPN (SSO / SAML-federated)

AWS Client VPN endpoint authenticated against an external SAML identity provider (Entra ID) with group-scoped authorization rules. Each user signs in with their own IdP account via the AWS-provided VPN client; the groups in the SAML memberOf claim decide which destination CIDRs they may reach.

Authorization rules use longest-prefix matching per destination: a rule for a specific CIDR shadows any broader rule, so every specific CIDR must carry a rule for EVERY group that may reach it (the caller builds this matrix).

The endpoint security group is created by the caller and passed in, so an existing certificate-auth endpoint can share it during migration.

Requirements

No requirements.

Providers

Name Version
aws n/a

Modules

No modules.

Resources

Name Type
aws_cloudwatch_log_group.vpn resource
aws_ec2_client_vpn_authorization_rule.this resource
aws_ec2_client_vpn_endpoint.this resource
aws_ec2_client_vpn_network_association.this resource

Inputs

Name Description Type Default Required
association_subnet_ids Subnets to associate the endpoint with (one per AZ; each association is billed hourly) list(string) n/a yes
authorization_rules Authorization rule matrix: key => { cidr, group_id (IdP group object ID from the memberOf claim; null authorizes all groups), description } 
map(object({
    cidr        = string
    group_id    = optional(string)
    description = string
  }))
 n/a yes
base_tags Base tags applied to all resources map(string) n/a yes
client_cidr CIDR range assigned to VPN clients (must not overlap the VPC CIDR) string n/a yes
dns_servers DNS servers pushed to clients (the VPC resolver, so private zones resolve) list(string) n/a yes
name_prefix Resource name prefix, e.g. stage-euc1-core string n/a yes
saml_provider_arn IAM SAML provider ARN for the VPN enterprise app (federated authentication) string n/a yes
security_group_ids Security groups applied to the endpoint ENIs (pass the shared vpn_endpoint SG so downstream rules keep working) list(string) n/a yes
self_service_saml_provider_arn IAM SAML provider ARN for the self-service portal (usually the same app); null disables the portal string null no
server_certificate_arn ACM ARN of the VPN server certificate string n/a yes
session_timeout_hours Maximum VPN session duration in hours (valid: 8, 10, 12, 24) number 8 no
vpc_id VPC the endpoint attaches to string n/a yes

Outputs

Name Description
endpoint_dns_name DNS name clients connect to
endpoint_id Client VPN endpoint ID — use to download the .ovpn client config
log_group_name CloudWatch log group receiving connection logs (usernames included with SAML auth)
self_service_portal_url Self-service portal URL where users download their VPN client configuration