trackit/terraform-aws-client-vpn

Terraform module which creates Client VPN resources on AWS

AWS Client VPN Terraform module

Terraform module which creates Client VPN Endpoint resources on AWS.

These type of resources are supported:

• ACM Certificate
• EC2 Client VPN Endpoint
• EC2 Client VPN Network association
• CloudWatch Log Group
• CloudWatch Log Stream

Terraform versions

Terraform 0.12 and newer.

Requirements

Name	Version
terraform	>= 0.12
aws	>= 2.49
bash

Upcoming features

• Client certificate revocation list
• Self Service VPN Portal

Terraform

This project is using terraform to deploy infrastructure, you can download it here: https://learn.hashicorp.com/tutorials/terraform/install-cli

Deploy

$ cd ./tf
$ terraform init
$ terraform plan
$ terraform apply

You may need to add execution permission :

chmod u+x .terraform/modules/client_vpn/scripts/*

Destroy

$ terraform destroy

Example

Using federated authentification (best security) :

• AWS VPN Client download link : https://aws.amazon.com/vpn/client-vpn-download/
• You can find the generated Client VPN configuration into your terraform folder.
• Each user have a login/password to authenticate.

module "client_vpn" {
  source                = "github.com/trackit/terraform-aws-client-vpn?ref=v0.2.0"
  region                = "us-east-1"
  env                   = "production"
  cert_issuer           = "mycompany.internal"
  cert_server_name      = "mycompany"
  aws_tenant_name       = "aws"
  clients               = ["client"]
  subnet_id             = "subnet-12345678"
  client_cidr_block     = "10.250.0.0/16"
  target_cidr_block     = "10.0.0.0/16"
  vpn_name              = "My VPN Endpoint"
  client_auth           = "federated-authentication"
  saml_provider_arn     = "arn:12345678"
}

Server certificate authentification only (less secure)

• You can find the generated Client VPN configuration into your terraform folder.
• Be carefull no user/password needed. Only the configuration file so do not lost it.

module "client_vpn" {
  source                = "github.com/trackit/terraform-aws-client-vpn?ref=v0.2.0"
  region                = "us-east-1"
  env                   = "production"
  cert_issuer           = "mycompany.internal"
  cert_server_name      = "mycompany"
  aws_tenant_name       = "aws"
  clients               = ["client"]
  subnet_id             = "subnet-12345678"
  client_cidr_block     = "10.250.0.0/16"
  target_cidr_block     = "10.0.0.0/16"
  vpn_name              = "My VPN Endpoint"
  client_auth           = "certificate-authentication"
}

Variable list

Name	Description	Type	Default
region	Region to work on.	string
env	The environment (e.g. prod, dev, stage)	string	"prod"
clients	A list of client certificate name	list(string)	["client"]
cert_issuer	Common Name for CA Certificate	list(string)	"CA"
cert_server_name	Name for the Server Certificate	string	"Server"
aws_tenant_name	Name for the AWS Tenant	string	"AWS"
key_save_folder	Where to store keys (relative to pki folder)	string	"clientvpn_keys"
subnet_id	The subnet ID to which we need to associate the VPN Client Connection.	string
target_cidr_block	The CIDR block to wich the client will have access to. Might be VPC CIDR's block for example.	string
dns_servers	Information about the DNS servers to be used for DNS resolution. A Client VPN endpoint can have up to two DNS servers.	list(string)	null
vpn_name	The name of the VPN Client Connection.	string	"VPN"
cloudwatch_enabled	Indicates whether connection logging is enabled.	bool	true
cloudwatch_log_group	The name of the cloudwatch log group.	string	vpn_endpoint_cloudwatch_log_group
cloudwatch_log_stream	The name of the cloudwatch log stream.	string	vpn_endpoint_cloudwatch_log_stream
aws_cli_profile_name	The name of the aws cli profile used in scripts	string	default
client_auth	the type of client authentication to be used : certificate-authentication / directory-service-authentication / federated-authentication	string	certificate-authentication
active_directory_id	The ID of the Active Directory to be used for authentication if type is directory-service-authentication	string	null
root_certificate_chain_arn	The ARN of the client certificate. The certificate must be signed by a certificate authority (CA) and it must be provisioned in AWS Certificate Manager (ACM). Only necessary when type is set to certificate-authentication.	string	null
saml_provider_arn	The ARN of the IAM SAML identity provider if type is federated-authentication	string	null

Output

Name	Description
kms_sops_arn
decrypt_command	Output of the decrypt script
encrypt_command	Output of the encrypt script
server_certificate_arn	The ARN of the generated Server Certificate
env	Environment variable
pki_folder_name	Generated certificate folder
client_vpn_endpoint_id	The ID of the Client VPN endpoint.
client_vpn_endpoint_arn	The ARN of the Client VPN endpoint.
client_vpn_endpoint_dns_name	The DNS name to be used by clients when establishing their VPN session.
client_vpn_endpoint_status	The current state of the Client VPN endpoint.

How does it work ?

Server certificate generation (scripts/prepare_easyrsa.sh)

1. Clone the latest easy-rsa repo.
2. Generate the CA and Server certificates and keys.
3. Copy the files to the defined KEY_SAVE_FOLDER.
4. the Server certificate is uploaded into AWS ACM.

Client certificate generation (scripts/create_client.sh)

1. Using the previous created PKI, generate a client certificate / key pair.
2. Then move it to the KEY_SAVE_FOLDER.

Create a VPN Endpoint Ressource

resource "aws_ec2_client_vpn_endpoint" "client_vpn" {
  depends_on             = [aws_acm_certificate.server_cert]
  description            = var.vpn_name
  server_certificate_arn = aws_acm_certificate.server_cert.arn
  client_cidr_block      = var.client_cidr_block
  split_tunnel           = true
  dns_servers            = var.dns_servers

  lifecycle {
    ignore_changes = [server_certificate_arn, authentication_options]
  }

  authentication_options {
    type                        = var.client_auth
    active_directory_id         = var.active_directory_id
    root_certificate_chain_arn  = var.root_certificate_chain_arn
    saml_provider_arn           = var.saml_provider_arn
  }

  connection_log_options {
    enabled               = var.cloudwatch_enabled
    cloudwatch_log_group  = aws_cloudwatch_log_group.client_vpn.name
    cloudwatch_log_stream = aws_cloudwatch_log_stream.client_vpn.name
  }

  provisioner "local-exec" {
    environment = merge(local.provisioner_base_env, {
      "CLIENT_VPN_ID" = self.id
    })
    command = "${path.module}/scripts/authorize_client.sh"
  }

  tags = {
    Name = var.vpn_name
  }
}

Authorize the VPN Traffic (scripts/authorize_client.sh)

1. With aws-cli allow traffic to TARGET_CIDR from CLIENT_VPN_ID

Generate the vpn configuration (scripts/export_client_vpn_config.sh)

1. With aws-cli export the ovpn configuration file.
2. Add the client certificate to end of it.
3. Add the opvn configuration to AWS VPN Client.
4. Start the VPN.