AWS CDK Reference

Appearance

v2.273.0

ClientVpnEndpointOptions Struct ​

Options for a client VPN endpoint.

Source
aws-ec2/lib/client-vpn-endpoint.ts
Type last changed
v2.235.0 · 15 Jan 2026

Example ​

ts
vpc.addClientVpnEndpoint('Endpoint', {
  cidr: '10.100.0.0/16',
  serverCertificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/server-certificate-id',
  // Mutual authentication
  clientCertificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/client-certificate-id',
  // User-based authentication
  userBasedAuthentication: ec2.ClientVpnUserBasedAuthentication.federated(samlProvider),
});

Properties ​

authorizeAllUsersToVpcCidrbooleanauthorize_all_users_to_vpc_cidrboolauthorizeAllUsersToVpcCidrBooleanAuthorizeAllUsersToVpcCidrboolAuthorizeAllUsersToVpcCidr*bool= true#
Whether to authorize all users to the VPC CIDR.

This automatically creates an authorization rule. Set this to false and use addAuthorizationRule() to create your own rules instead.

cidrstringcidrstrcidrStringCidrstringCidr*stringrequired#
The IPv4 address range, in CIDR notation, from which to assign client IP addresses.
notes

The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually.

Changing the address range will replace the Client VPN endpoint.

The CIDR block should be /22 or greater.

clientCertificateArnstringclient_certificate_arnstrclientCertificateArnStringClientCertificateArnstringClientCertificateArn*string= use user-based authentication#
The ARN of the client certificate for mutual authentication.

The certificate must be signed by a certificate authority (CA) and it must be provisioned in AWS Certificate Manager (ACM).

clientConnectionHandlerIClientVpnConnectionHandlerclient_connection_handlerIClientVpnConnectionHandlerclientConnectionHandlerIClientVpnConnectionHandlerClientConnectionHandlerIClientVpnConnectionHandlerClientConnectionHandlerIClientVpnConnectionHandler= no connection handler#
The AWS Lambda function used for connection authorization.

The name of the Lambda function must begin with the AWSClientVPN- prefix

clientLoginBannerstringclient_login_bannerstrclientLoginBannerStringClientLoginBannerstringClientLoginBanner*string= no banner is presented to the cl…#
Customizable text that will be displayed in a banner on AWS provided clients when a VPN session is established.

UTF-8 encoded characters only. Maximum of 1400 characters.

default

Default: no banner is presented to the client

clientRouteEnforcementOptionsClientRouteEnforcementOptionsclient_route_enforcement_optionsClientRouteEnforcementOptionsclientRouteEnforcementOptionsClientRouteEnforcementOptionsClientRouteEnforcementOptionsClientRouteEnforcementOptionsClientRouteEnforcementOptionsClientRouteEnforcementOptions= undefined - AWS Client VPN defau…#
Options for Client Route Enforcement.
notes · default

Client Route Enforcement is a feature of Client VPN that helps enforce administrator defined routes on devices connected through the VPN. This feature helps improve your security posture by ensuring that network traffic originating from a connected client is not inadvertently sent outside the VPN tunnel.

Default: undefined - AWS Client VPN default setting is disable client route enforcement

descriptionstringdescriptionstrdescriptionStringDescriptionstringDescription*string= no description#
A brief description of the Client VPN endpoint.
disconnectOnSessionTimeoutbooleandisconnect_on_session_timeoutbooldisconnectOnSessionTimeoutBooleanDisconnectOnSessionTimeoutboolDisconnectOnSessionTimeout*bool= undefined - AWS Client VPN defau…#
Indicates whether the client VPN session is disconnected after the maximum `sessionTimeout` is reached.

If true, users are prompted to reconnect client VPN. If false, client VPN attempts to reconnect automatically.

default

Default: undefined - AWS Client VPN default is true

dnsServersstring[]dns_serverstyping.List[str]dnsServersList<String>DnsServersstring[]DnsServers*[]*string= use the DNS address configured o…#
Information about the DNS servers to be used for DNS resolution.

A Client VPN endpoint can have up to two DNS servers.

default

Default: use the DNS address configured on the device

loggingbooleanloggingboolloggingBooleanLoggingboolLogging*bool= true#
Whether to enable connections logging.
logGroupILogGroupReflog_groupILogGroupReflogGroupILogGroupRefLogGroupILogGroupRefLogGroupILogGroupRef= a new group is created#
A CloudWatch Logs log group for connection logging.
logStreamILogStreamReflog_streamILogStreamReflogStreamILogStreamRefLogStreamILogStreamRefLogStreamILogStreamRef= a new stream is created#
A CloudWatch Logs log stream for connection logging.
portVpnPortportVpnPortportVpnPortPortVpnPortPortVpnPort= VpnPort.HTTPS#
The port number to assign to the Client VPN endpoint for TCP and UDP traffic.
securityGroupsISecurityGroup[]security_groupstyping.List[ISecurityGroup]securityGroupsList<ISecurityGroup>SecurityGroupsISecurityGroup[]SecurityGroups*[]ISecurityGroup= a new security group is created#
The security groups to apply to the target network.
selfServicePortalbooleanself_service_portalboolselfServicePortalBooleanSelfServicePortalboolSelfServicePortal*bool= true#
Specify whether to enable the self-service portal for the Client VPN endpoint.
serverCertificateArnstringserver_certificate_arnstrserverCertificateArnStringServerCertificateArnstringServerCertificateArn*stringrequired#
The ARN of the server certificate.
sessionTimeoutClientVpnSessionTimeoutsession_timeoutClientVpnSessionTimeoutsessionTimeoutClientVpnSessionTimeoutSessionTimeoutClientVpnSessionTimeoutSessionTimeoutClientVpnSessionTimeout= ClientVpnSessionTimeout.TWENTY_F…#
The maximum VPN session duration time.
default

Default: ClientVpnSessionTimeout.TWENTY_FOUR_HOURS

splitTunnelbooleansplit_tunnelboolsplitTunnelBooleanSplitTunnelboolSplitTunnel*bool= false#
Indicates whether split-tunnel is enabled on the AWS Client VPN endpoint.
transportProtocolTransportProtocoltransport_protocolTransportProtocoltransportProtocolTransportProtocolTransportProtocolTransportProtocolTransportProtocolTransportProtocol= TransportProtocol.UDP#
The transport protocol to be used by the VPN session.
userBasedAuthenticationClientVpnUserBasedAuthenticationuser_based_authenticationClientVpnUserBasedAuthenticationuserBasedAuthenticationClientVpnUserBasedAuthenticationUserBasedAuthenticationClientVpnUserBasedAuthenticationUserBasedAuthenticationClientVpnUserBasedAuthentication= use mutual authentication#
The type of user-based authentication to use.
vpcSubnetsSubnetSelectionvpc_subnetsSubnetSelectionvpcSubnetsSubnetSelectionVpcSubnetsSubnetSelectionVpcSubnetsSubnetSelection= the VPC default strategy#
Subnets to associate to the client VPN endpoint.