# ClientVpnEndpoint

A client VPN connection.

Extends: Construct › Resource › ClientVpnEndpoint
Implements: IResource, IClientVpnEndpoint, IConnectable, IEnvironmentAware, IClientVpnEndpointRef, IConstruct, IDependable

- CloudFormation: [`AWS::EC2::ClientVpnEndpoint`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-clientvpnendpoint.html)
- L1 type: [`CfnClientVpnEndpoint`](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnClientVpnEndpoint.html)
- Source: [`aws-ec2/lib/client-vpn-endpoint.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-ec2/lib/client-vpn-endpoint.ts#L320)
- Type last changed: v2.224.0 · 13 Nov 2025

## Example

```ts
const endpoint = vpc.addClientVpnEndpoint('Endpoint', {
  cidr: '10.100.0.0/16',
  serverCertificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/server-certificate-id',
  userBasedAuthentication: ec2.ClientVpnUserBasedAuthentication.federated(samlProvider),
  authorizeAllUsersToVpcCidr: false,
});

endpoint.addAuthorizationRule('Rule', {
  cidr: '10.0.10.0/32',
  groupId: 'group-id',
});
```

## Initializer

```ts
new ClientVpnEndpoint(scope: Construct, id: string, props: ClientVpnEndpointProps)
```

## Construct Props

- `authorizeAllUsersToVpcCidr`: boolean = true — Whether to authorize all users to the VPC CIDR.

  This automatically creates an authorization rule. Set this to `false` and
  use `addAuthorizationRule()` to create your own rules instead.

- `cidr`: string (required) — The IPv4 address range, in CIDR notation, from which to assign client IP addresses.

  The address range cannot overlap with the local CIDR of the VPC
  in which the associated subnet is located, or the routes that you add manually.

  Changing the address range will replace the Client VPN endpoint.

  The CIDR block should be /22 or greater.

- `clientCertificateArn`: string — The ARN of the client certificate for mutual authentication.

  **Default:** use user-based authentication

  The certificate must be signed by a certificate authority (CA) and it must
  be provisioned in AWS Certificate Manager (ACM).

- `clientConnectionHandler`: [IClientVpnConnectionHandler](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IClientVpnConnectionHandler.html) — The AWS Lambda function used for connection authorization.

  **Default:** no connection handler

  The name of the Lambda function must begin with the `AWSClientVPN-` prefix

- `clientLoginBanner`: string — Customizable text that will be displayed in a banner on AWS provided clients when a VPN session is established.

  **Default:** no banner is presented to the client

  UTF-8 encoded characters only. Maximum of 1400 characters.

- `clientRouteEnforcementOptions`: [ClientRouteEnforcementOptions](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ClientRouteEnforcementOptions.html) — Options for Client Route Enforcement.

  **Default:** undefined - AWS Client VPN default setting is disable client route enforcement

  Client Route Enforcement is a feature of Client VPN that helps enforce administrator defined routes on devices connected through the VPN.
  This feature helps improve your security posture by ensuring that network traffic originating from a connected client is not inadvertently sent outside the VPN tunnel.

- `description`: string — A brief description of the Client VPN endpoint.

  **Default:** no description

- `disconnectOnSessionTimeout`: boolean — Indicates whether the client VPN session is disconnected after the maximum `sessionTimeout` is reached.

  **Default:** undefined - AWS Client VPN default is true

  If `true`, users are prompted to reconnect client VPN.
  If `false`, client VPN attempts to reconnect automatically.

- `dnsServers`: string[] — Information about the DNS servers to be used for DNS resolution.

  **Default:** use the DNS address configured on the device

  A Client VPN endpoint can have up to two DNS servers.

- `logging`: boolean = true — Whether to enable connections logging.

- `logGroup`: [ILogGroupRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_logs.ILogGroupRef.html) — A CloudWatch Logs log group for connection logging.

  **Default:** a new group is created

- `logStream`: [ILogStreamRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_logs.ILogStreamRef.html) — A CloudWatch Logs log stream for connection logging.

  **Default:** a new stream is created

- `port`: [VpnPort](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.VpnPort.html) = VpnPort.HTTPS — The port number to assign to the Client VPN endpoint for TCP and UDP traffic.

- `securityGroups`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html)[] — The security groups to apply to the target network.

  **Default:** a new security group is created

- `selfServicePortal`: boolean = true — Specify whether to enable the self-service portal for the Client VPN endpoint.

- `serverCertificateArn`: string (required) — The ARN of the server certificate.

- `sessionTimeout`: [ClientVpnSessionTimeout](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ClientVpnSessionTimeout.html) — The maximum VPN session duration time.

  **Default:** ClientVpnSessionTimeout.TWENTY_FOUR_HOURS

- `splitTunnel`: boolean = false — Indicates whether split-tunnel is enabled on the AWS Client VPN endpoint.

- `transportProtocol`: [TransportProtocol](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.TransportProtocol.html) = TransportProtocol.UDP — The transport protocol to be used by the VPN session.

- `userBasedAuthentication`: [ClientVpnUserBasedAuthentication](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ClientVpnUserBasedAuthentication.html) — The type of user-based authentication to use.

  **Default:** use mutual authentication

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) (required) — The VPC to connect to.

- `vpcSubnets`: [SubnetSelection](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetSelection.html) — Subnets to associate to the client VPN endpoint.

  **Default:** the VPC default strategy

## Properties

- `clientVpnEndpointRef`: [ClientVpnEndpointReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_ec2.ClientVpnEndpointReference.html) — A reference to a ClientVpnEndpoint resource.

- `connections`: [Connections](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Connections.html) — Allows specify security group connections for the endpoint.

- `endpointId`: string — The endpoint ID.

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) — The environment this resource belongs to.

  For resources that are created and managed in a Stack (those created by
  creating new class instances like `new Role()`, `new Bucket()`, etc.), this
  is always the same as the environment of the stack they belong to.

  For referenced resources (those obtained from referencing methods like
  `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
  different than the stack they were imported into.

- `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) — The tree node.

- `PROPERTY_INJECTION_ID`: string (static) — Uniquely identifies this class.

- `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) — The stack in which this resource is defined.

- `targetNetworksAssociated`: [IDependable](/cdk/api/v2/docs/constructs.IDependable.html) — Dependable that can be depended upon to force target networks associations.

## Methods

- `addAuthorizationRule(id: string, props: ClientVpnAuthorizationRuleOptions): ClientVpnAuthorizationRule` — Adds an authorization rule to this endpoint.

- `addRoute(id: string, props: ClientVpnRouteOptions): ClientVpnRoute` — Adds a route to this endpoint.

- `applyCrossStackReferenceStrength(strength: ReferenceStrength): void` — Override the cross-stack reference strength for this resource.

  When set, any cross-stack reference to this resource will use the specified
  mechanism instead of the global default determined by the
  `@aws-cdk/core:defaultCrossStackReferences` context key. This is useful for
  selectively weakening specific references to avoid the "deadly embrace" problem
  without changing the app-wide default.

  **Parameters**

  - `strength` — - The reference strength to use for this resource.

- `applyRemovalPolicy(policy: RemovalPolicy): void` — Apply the given removal policy to this resource.

  The Removal Policy controls what happens to this resource when it stops
  being managed by CloudFormation, either because you've removed it from the
  CDK application or because you've made a change that requires the resource
  to be replaced.

  The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
  account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).

- `fromEndpointAttributes(scope: Construct, id: string, attrs: ClientVpnEndpointAttributes): IClientVpnEndpoint` (static) — Import an existing client VPN endpoint.

- `isConstruct(x: any): boolean` (static) — Checks if `x` is a construct.

  Use this method instead of `instanceof` to properly detect `Construct`
  instances, even when the construct library is symlinked.

  Explanation: in JavaScript, multiple copies of the `constructs` library on
  disk are seen as independent, completely different libraries. As a
  consequence, the class `Construct` in each copy of the `constructs` library
  is seen as a different class, and an instance of one class will not test as
  `instanceof` the other class. `npm install` will not create installations
  like this, but users may manually symlink construct libraries together or
  use a monorepo tool: in those cases, multiple copies of the `constructs`
  library can be accidentally installed, and `instanceof` will behave
  unpredictably. It is safest to avoid using `instanceof`, and using
  this type-testing method instead.

  **Parameters**

  - `x` — Any object.

  **Returns:** true if `x` is an object created from a class which extends `Construct`.

- `isOwnedResource(construct: IConstruct): boolean` (static) — Returns true if the construct was created by CDK, and false otherwise.

- `isResource(construct: IConstruct): boolean` (static) — Check whether the given construct is a Resource.

- `toString(): string` — Returns a string representation of this construct.

- `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct.

  Mixins are applied in order. The list of constructs is captured at the
  start of the call, so constructs added by a mixin will not be visited.
  Use multiple `with()` calls if subsequent mixins should apply to added
  constructs.