| authentication_options |
List of authentication options for the Client VPN endpoint. |
list(object({
type = string
active_directory_id = optional(string)
root_certificate_chain_arn = optional(string)
saml_provider_arn = optional(string)
self_service_saml_provider_arn = optional(string)
})) |
n/a |
yes |
| authorization_rules |
List of authorization rules to apply to the Client VPN. |
list(object({
cidr = string
description = optional(string)
access_group_id = optional(string)
authorize_all_groups = optional(bool)
})) |
[] |
no |
| client_cidr_block |
The IPv4 address range in CIDR notation to assign client IP addresses. Required unless traffic_ip_address_type is ipv6. |
string |
null |
no |
| client_connect_options |
Client connect options for managing connection authorization for new client connections. |
object({
enabled = bool
lambda_function_arn = optional(string)
}) |
{
"enabled": false,
"lambda_function_arn": null
} |
no |
| client_login_banner_options |
Client login banner options. |
object({
enabled = bool
banner_text = optional(string)
}) |
{
"banner_text": null,
"enabled": false
} |
no |
| client_route_enforcement_options |
Options to enforce administrator-defined routes on connected clients |
object({
enforced = bool
}) |
{
"enforced": false
} |
no |
| connection_log_options |
Configuration block for connection logging. |
object({
enabled = bool
cloudwatch_log_group = optional(string)
cloudwatch_log_stream = optional(string)
}) |
{
"enabled": true
} |
no |
| description |
Description for the Client VPN endpoint. |
string |
null |
no |
| disconnect_on_session_timeout |
Whether to disconnect the client VPN session after the maximum session_timeout_hours is reached. |
bool |
false |
no |
| dns_servers |
Custom DNS servers to use. Can specify up to two. |
list(string) |
[] |
no |
| endpoint_ip_address_type |
IP address type for the Client VPN endpoint. Valid values: ipv4, ipv6, dual-stack. |
string |
"ipv4" |
no |
| kms_key_id |
KMS key ARN to encrypt the logs. |
string |
null |
no |
| log_group_class |
Log class of the log group. |
string |
"STANDARD" |
no |
| log_group_name |
Name of the CloudWatch log group. |
string |
null |
no |
| log_stream_name |
Name of the CloudWatch log stream. |
string |
null |
no |
| name |
Name tag for the Client VPN endpoint. |
string |
null |
no |
| name_prefix |
Prefix name for the CloudWatch log group. |
string |
null |
no |
| region |
AWS region where this resource will be created. |
string |
null |
no |
| retention_in_days |
Number of days to retain log events in the log group. |
number |
0 |
no |
| route_definitions |
List of CIDRs to create VPN routes for. |
list(object({
cidr = string
description = optional(string)
})) |
[] |
no |
| security_group_ids |
List of security group IDs to associate with the Client VPN endpoint. |
list(string) |
[] |
no |
| self_service_portal |
Enable or disable the self-service portal. Valid values: enabled, disabled. |
string |
"disabled" |
no |
| server_certificate_arn |
The ARN of the ACM server certificate for the Client VPN endpoint. |
string |
n/a |
yes |
| session_timeout_hours |
Maximum session duration in hours. Valid values: 8, 10, 12, 24. |
number |
24 |
no |
| skip_destroy |
Whether to destroy the log group when resource is destroyed. |
bool |
false |
no |
| split_tunnel |
Whether split-tunnel is enabled. |
bool |
false |
no |
| subnet_ids |
List of subnet IDs to associate with the Client VPN endpoint for high availability. |
list(string) |
n/a |
yes |
| tags |
Map of tags to assign to the Client VPN endpoint. |
map(string) |
{} |
no |
| traffic_ip_address_type |
IP address type for traffic within the Client VPN tunnel. Valid values: ipv4, ipv6, dual-stack. |
string |
"ipv4" |
no |
| transport_protocol |
Transport protocol for the VPN session. Valid values: udp, tcp. |
string |
"udp" |
no |
| vpc_id |
The ID of the VPC to associate with the Client VPN endpoint. |
string |
null |
no |
| vpn_port |
Port number for the Client VPN endpoint. Valid values: 443, 1194. |
number |
443 |
no |