2020-01-03 :: 4 min to read

§ AWS Client VPN with mutual TLS

const cdk = require('@aws-cdk/core');
const ec2 = require('@aws-cdk/aws-ec2');
const logs = require('@aws-cdk/aws-logs');
const certmgr = require('@aws-cdk/aws-certificatemanager');

class VpnStack extends cdk.Stack {
    constructor(scope, id, props) {
        super(scope, id, props);

        // this variable we would pass assuming you already have a certificate
        // you could use the same for a server and a client endpoint parts of the config
        // if all the client ones would have the same CA
        const {certArn} = props;
    }
}

module.exports = { VpnStack };

const vpc = ec2.Vpc.fromLookup(this, 'ClientVpnVpc', {
    // I'm using default one, 
    // but obviously you could create new or choose another existing.
    // this action will require explicitly defined region and account 
    // and creates a context file to cache the knowledge 
    // (or fetches it from the aws before the synth).
    // About region and acc I would show later, but for me it looks weird, 
    // why I have to define it once more?
    isDefault: true 
});

const clientCert = certmgr.Certificate.fromCertificateArn(
    this,
    'ClientCertificate',
    certArn
);
const serverCert = certmgr.Certificate.fromCertificateArn(
    this,
    'ServerCertificate',
    certArn
);

const logGroup = new logs.LogGroup(this, 'ClientVpnLogGroup', {
    retention: logs.RetentionDays.THREE_MONTHS
});

const logStream = logGroup.addStream('ClientVpnLogStream');

const endpoint = new ec2.CfnClientVpnEndpoint(this, 'ClientVpnEndpoint', {
    authenticationOptions: [{ // actually, don't know if I enable both - would it require both or just pick the one?
        type: "certificate-authentication", 
        mutualAuthentication: {
            clientRootCertificateChainArn: clientCert.certificateArn
        }
    }],
    // Nice article where this CIDR comes from (spoiler: its random private)
    // https://openvpn.net/community-resources/numbering-private-subnets/
    // Also it shouldn't clash with existing subnets
    clientCidrBlock: "10.27.0.0/20",
    connectionLogOptions: {
        enabled: true,
        cloudwatchLogGroup: logGroup.logGroupName,
        cloudwatchLogStream: logStream.logStreamName
    },
    serverCertificateArn: serverCert.certificateArn,
    // If you need to route all the traffic through the VPN (not only for the resources inside, turn this off)
    splitTunnel: true,
    // You can omit this, 
    // but then private resources and private hosted zone resolution won't work, 
    // since on your client side it wouldn't be delivered anyhow
    // at least Tunnelblick says nothing about DNS when this is empty
    dnsServers: ["172.1.0.2"] // vpc cidr base + .2 (Mine was 172.1.0.0/16)
});

// I didn't have a private/isolated subnets in a default vpc, so got the public ones.
vpc.publicSubnets.map(subnet => new ec2.CfnClientVpnTargetNetworkAssociation(this, 'ClientVpnNetworkAssociation-' + subnet.subnetId, {
    clientVpnEndpointId: endpoint.ref,
    subnetId: subnet.subnetId
}));

// This thing is designed more for AD controls, so for the mutual TLS its quite permissive
// To control precisely, you could assign a security group, but for now its not implemented in the CF yet.
new ec2.CfnClientVpnAuthorizationRule(this, 'ClientVpnAuthRule', {
    clientVpnEndpointId: endpoint.ref,
    targetNetworkCidr: "0.0.0.0/0",
    authorizeAllGroups: true,
    description: "Allow all"
});

const cdk = require('@aws-cdk/core');
const { VpnStack } = require('../lib/vpn-stack');

const app = new cdk.App();
new VpnStack(app, 'client-vpn', {
    // this thing can be passed as a context param or as a aws parameter, 
    // but I'm getting that from a shell script and pass it with a file which then read here
    // a bit hacky, but works!
    certArn: "some existing arn",
    // to enable vpc discovery in the stack explicit env variables required with region and account
    env: {
        account: process.env.CDK_DEFAULT_ACCOUNT,
        region: process.env.CDK_DEFAULT_REGION,
    },
});