We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Cloud Infrastructure
Free preview: the first 2 parts of this 6-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Cloud Infrastructure
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
Your production database runs in a private subnet. No public IP. No Internet Gateway route. Exactly as it should be. But your developer working from a coffee shop in Berlin needs to run a migration against that database. Your on-call engineer at home at 2 AM needs to check the internal monitoring dashboard.
A Client VPN gives individual users secure access to private cloud resources from any location. The developer installs a VPN client on their laptop, authenticates (usually with certificates + MFA), and suddenly their machine can resolve and reach private IP addresses inside your VPC, as if they were sitting in the data center.
This is fundamentally different from a site-to-site VPN, which connects entire networks. A Client VPN connects a single device to a network. It's the remote access pattern that every company with cloud infrastructure eventually needs.
AWS Client VPN is a managed service that handles the server-side infrastructure:
Components:
Authentication options:
| Method | Security | Complexity |
|---|---|---|
| Mutual TLS (certificates) | High | Medium, requires PKI |
| Active Directory | High | Medium, requires AD integration |
| SAML-based SSO | High | Low, integrates with Okta, Azure AD |
| Combined (cert + AD/SAML) | Very high | Higher, but recommended |
Cost: $0.10/hr per association + $0.05/hr per connection. Ten developers connected 8 hours/day = ~$80/month. Not cheap, but cheaper than the alternative (exposing private resources publicly).
The flow: User opens VPN client, connects to the endpoint, authenticates, gets assigned a private IP from a special CIDR range, and can now reach private resources. All traffic to the VPC flows through an encrypted tunnel. Traffic to public sites can either flow through the tunnel (full) or directly (split).