Endpoint

Provides an AWS Client VPN endpoint for OpenVPN clients. For more information on usage, please see the AWS Client VPN Administrator’s Guide.

Example Usage

using Pulumi;
using Aws = Pulumi.Aws;

class MyStack : Stack
{
    public MyStack()
    {
        var example = new Aws.Ec2ClientVpn.Endpoint("example", new Aws.Ec2ClientVpn.EndpointArgs
        {
            AuthenticationOptions = 
            {
                new Aws.Ec2ClientVpn.Inputs.EndpointAuthenticationOptionArgs
                {
                    RootCertificateChainArn = aws_acm_certificate.Root_cert.Arn,
                    Type = "certificate-authentication",
                },
            },
            ClientCidrBlock = "10.0.0.0/16",
            ConnectionLogOptions = new Aws.Ec2ClientVpn.Inputs.EndpointConnectionLogOptionsArgs
            {
                CloudwatchLogGroup = aws_cloudwatch_log_group.Lg.Name,
                CloudwatchLogStream = aws_cloudwatch_log_stream.Ls.Name,
                Enabled = true,
            },
            Description = "clientvpn-example",
            ServerCertificateArn = aws_acm_certificate.Cert.Arn,
        });
    }

}

package main

import (
    "github.com/pulumi/pulumi-aws/sdk/v2/go/aws/ec2clientvpn"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        _, err := ec2clientvpn.NewEndpoint(ctx, "example", &ec2clientvpn.EndpointArgs{
            AuthenticationOptions: ec2clientvpn.EndpointAuthenticationOptionArray{
                &ec2clientvpn.EndpointAuthenticationOptionArgs{
                    RootCertificateChainArn: pulumi.String(aws_acm_certificate.Root_cert.Arn),
                    Type:                    pulumi.String("certificate-authentication"),
                },
            },
            ClientCidrBlock: pulumi.String("10.0.0.0/16"),
            ConnectionLogOptions: &ec2clientvpn.EndpointConnectionLogOptionsArgs{
                CloudwatchLogGroup:  pulumi.String(aws_cloudwatch_log_group.Lg.Name),
                CloudwatchLogStream: pulumi.String(aws_cloudwatch_log_stream.Ls.Name),
                Enabled:             pulumi.Bool(true),
            },
            Description:          pulumi.String("clientvpn-example"),
            ServerCertificateArn: pulumi.String(aws_acm_certificate.Cert.Arn),
        })
        if err != nil {
            return err
        }
        return nil
    })
}

import pulumi
import pulumi_aws as aws

example = aws.ec2clientvpn.Endpoint("example",
    authentication_options=[{
        "rootCertificateChainArn": aws_acm_certificate["root_cert"]["arn"],
        "type": "certificate-authentication",
    }],
    client_cidr_block="10.0.0.0/16",
    connection_log_options={
        "cloudwatchLogGroup": aws_cloudwatch_log_group["lg"]["name"],
        "cloudwatchLogStream": aws_cloudwatch_log_stream["ls"]["name"],
        "enabled": True,
    },
    description="clientvpn-example",
    server_certificate_arn=aws_acm_certificate["cert"]["arn"])

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.ec2clientvpn.Endpoint("example", {
    authenticationOptions: [{
        rootCertificateChainArn: aws_acm_certificate_root_cert.arn,
        type: "certificate-authentication",
    }],
    clientCidrBlock: "10.0.0.0/16",
    connectionLogOptions: {
        cloudwatchLogGroup: aws_cloudwatch_log_group_lg.name,
        cloudwatchLogStream: aws_cloudwatch_log_stream_ls.name,
        enabled: true,
    },
    description: "clientvpn-example",
    serverCertificateArn: aws_acm_certificate_cert.arn,
});

Create a Endpoint Resource

new Endpoint(name: string, args: EndpointArgs, opts?: CustomResourceOptions);

def Endpoint(resource_name, opts=None, authentication_options=None, client_cidr_block=None, connection_log_options=None, description=None, dns_servers=None, server_certificate_arn=None, split_tunnel=None, tags=None, transport_protocol=None, __props__=None);

func NewEndpoint(ctx *Context, name string, args EndpointArgs, opts ...ResourceOption) (*Endpoint, error)

public Endpoint(string name, EndpointArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args EndpointArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args EndpointArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args EndpointArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

Endpoint Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The Endpoint resource accepts the following input properties:

AuthenticationOptions List<EndpointAuthenticationOptionArgs>: Information about the authentication method to be used to authenticate clients.
ClientCidrBlock string: The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater.
ConnectionLogOptions EndpointConnectionLogOptionsArgs: Information about the client connection logging options.
ServerCertificateArn string: The ARN of the ACM server certificate.
Description string: Name of the repository.
DnsServers List<string>: Information about the DNS servers to be used for DNS resolution. A Client VPN endpoint can have up to two DNS servers. If no DNS server is specified, the DNS address of the VPC that is to be associated with Client VPN endpoint is used as the DNS server.
SplitTunnel bool: Indicates whether split-tunnel is enabled on VPN endpoint. Default value is false.
Tags Dictionary<string, string>: A map of tags to assign to the resource.
TransportProtocol string: The transport protocol to be used by the VPN session. Default value is udp.

AuthenticationOptions []EndpointAuthenticationOption: Information about the authentication method to be used to authenticate clients.
ClientCidrBlock string: The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater.
ConnectionLogOptions EndpointConnectionLogOptions: Information about the client connection logging options.
ServerCertificateArn string: The ARN of the ACM server certificate.
Description string: Name of the repository.
DnsServers []string: Information about the DNS servers to be used for DNS resolution. A Client VPN endpoint can have up to two DNS servers. If no DNS server is specified, the DNS address of the VPC that is to be associated with Client VPN endpoint is used as the DNS server.
SplitTunnel bool: Indicates whether split-tunnel is enabled on VPN endpoint. Default value is false.
Tags map[string]string: A map of tags to assign to the resource.
TransportProtocol string: The transport protocol to be used by the VPN session. Default value is udp.

authenticationOptions EndpointAuthenticationOption[]: Information about the authentication method to be used to authenticate clients.
clientCidrBlock string: The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater.
connectionLogOptions EndpointConnectionLogOptions: Information about the client connection logging options.
serverCertificateArn string: The ARN of the ACM server certificate.
description string: Name of the repository.
dnsServers string[]: Information about the DNS servers to be used for DNS resolution. A Client VPN endpoint can have up to two DNS servers. If no DNS server is specified, the DNS address of the VPC that is to be associated with Client VPN endpoint is used as the DNS server.
splitTunnel boolean: Indicates whether split-tunnel is enabled on VPN endpoint. Default value is false.
tags {[key: string]: string}: A map of tags to assign to the resource.
transportProtocol string: The transport protocol to be used by the VPN session. Default value is udp.

authentication_options List[EndpointAuthenticationOption]: Information about the authentication method to be used to authenticate clients.
client_cidr_block str: The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater.
connection_log_options Dict[EndpointConnectionLogOptions]: Information about the client connection logging options.
server_certificate_arn str: The ARN of the ACM server certificate.
description str: Name of the repository.
dns_servers List[str]: Information about the DNS servers to be used for DNS resolution. A Client VPN endpoint can have up to two DNS servers. If no DNS server is specified, the DNS address of the VPC that is to be associated with Client VPN endpoint is used as the DNS server.
split_tunnel bool: Indicates whether split-tunnel is enabled on VPN endpoint. Default value is false.
tags Dict[str, str]: A map of tags to assign to the resource.
transport_protocol str: The transport protocol to be used by the VPN session. Default value is udp.

Outputs

All input properties are implicitly available as output properties. Additionally, the Endpoint resource produces the following output properties:

Arn string: The ARN of the Client VPN endpoint.
DnsName string: The DNS name to be used by clients when establishing their VPN session.
Id string: The provider-assigned unique ID for this managed resource.
Status string: The current state of the Client VPN endpoint.

Arn string: The ARN of the Client VPN endpoint.
DnsName string: The DNS name to be used by clients when establishing their VPN session.
Id string: The provider-assigned unique ID for this managed resource.
Status string: The current state of the Client VPN endpoint.

arn string: The ARN of the Client VPN endpoint.
dnsName string: The DNS name to be used by clients when establishing their VPN session.
id string: The provider-assigned unique ID for this managed resource.
status string: The current state of the Client VPN endpoint.

arn str: The ARN of the Client VPN endpoint.
dns_name str: The DNS name to be used by clients when establishing their VPN session.
id str: The provider-assigned unique ID for this managed resource.
status str: The current state of the Client VPN endpoint.

Look up an Existing Endpoint Resource

Get an existing Endpoint resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: EndpointState, opts?: CustomResourceOptions): Endpoint

static get(resource_name, id, opts=None, arn=None, authentication_options=None, client_cidr_block=None, connection_log_options=None, description=None, dns_name=None, dns_servers=None, server_certificate_arn=None, split_tunnel=None, status=None, tags=None, transport_protocol=None, __props__=None);

func GetEndpoint(ctx *Context, name string, id IDInput, state *EndpointState, opts ...ResourceOption) (*Endpoint, error)

public static Endpoint Get(string name, Input<string> id, EndpointState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Arn string: The ARN of the Client VPN endpoint.
AuthenticationOptions List<EndpointAuthenticationOptionArgs>: Information about the authentication method to be used to authenticate clients.
ClientCidrBlock string: The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater.
ConnectionLogOptions EndpointConnectionLogOptionsArgs: Information about the client connection logging options.
Description string: Name of the repository.
DnsName string: The DNS name to be used by clients when establishing their VPN session.
DnsServers List<string>: Information about the DNS servers to be used for DNS resolution. A Client VPN endpoint can have up to two DNS servers. If no DNS server is specified, the DNS address of the VPC that is to be associated with Client VPN endpoint is used as the DNS server.
ServerCertificateArn string: The ARN of the ACM server certificate.
SplitTunnel bool: Indicates whether split-tunnel is enabled on VPN endpoint. Default value is false.
Status string: The current state of the Client VPN endpoint.
Tags Dictionary<string, string>: A map of tags to assign to the resource.
TransportProtocol string: The transport protocol to be used by the VPN session. Default value is udp.

Arn string: The ARN of the Client VPN endpoint.
AuthenticationOptions []EndpointAuthenticationOption: Information about the authentication method to be used to authenticate clients.
ClientCidrBlock string: The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater.
ConnectionLogOptions EndpointConnectionLogOptions: Information about the client connection logging options.
Description string: Name of the repository.
DnsName string: The DNS name to be used by clients when establishing their VPN session.
DnsServers []string: Information about the DNS servers to be used for DNS resolution. A Client VPN endpoint can have up to two DNS servers. If no DNS server is specified, the DNS address of the VPC that is to be associated with Client VPN endpoint is used as the DNS server.
ServerCertificateArn string: The ARN of the ACM server certificate.
SplitTunnel bool: Indicates whether split-tunnel is enabled on VPN endpoint. Default value is false.
Status string: The current state of the Client VPN endpoint.
Tags map[string]string: A map of tags to assign to the resource.
TransportProtocol string: The transport protocol to be used by the VPN session. Default value is udp.

arn string: The ARN of the Client VPN endpoint.
authenticationOptions EndpointAuthenticationOption[]: Information about the authentication method to be used to authenticate clients.
clientCidrBlock string: The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater.
connectionLogOptions EndpointConnectionLogOptions: Information about the client connection logging options.
description string: Name of the repository.
dnsName string: The DNS name to be used by clients when establishing their VPN session.
dnsServers string[]: Information about the DNS servers to be used for DNS resolution. A Client VPN endpoint can have up to two DNS servers. If no DNS server is specified, the DNS address of the VPC that is to be associated with Client VPN endpoint is used as the DNS server.
serverCertificateArn string: The ARN of the ACM server certificate.
splitTunnel boolean: Indicates whether split-tunnel is enabled on VPN endpoint. Default value is false.
status string: The current state of the Client VPN endpoint.
tags {[key: string]: string}: A map of tags to assign to the resource.
transportProtocol string: The transport protocol to be used by the VPN session. Default value is udp.

arn str: The ARN of the Client VPN endpoint.
authentication_options List[EndpointAuthenticationOption]: Information about the authentication method to be used to authenticate clients.
client_cidr_block str: The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater.
connection_log_options Dict[EndpointConnectionLogOptions]: Information about the client connection logging options.
description str: Name of the repository.
dns_name str: The DNS name to be used by clients when establishing their VPN session.
dns_servers List[str]: Information about the DNS servers to be used for DNS resolution. A Client VPN endpoint can have up to two DNS servers. If no DNS server is specified, the DNS address of the VPC that is to be associated with Client VPN endpoint is used as the DNS server.
server_certificate_arn str: The ARN of the ACM server certificate.
split_tunnel bool: Indicates whether split-tunnel is enabled on VPN endpoint. Default value is false.
status str: The current state of the Client VPN endpoint.
tags Dict[str, str]: A map of tags to assign to the resource.
transport_protocol str: The transport protocol to be used by the VPN session. Default value is udp.

Supporting Types

EndpointAuthenticationOption

See the input and output API doc for this type.

Type string: The type of client authentication to be used. Specify certificate-authentication to use certificate-based authentication, or directory-service-authentication to use Active Directory authentication.
ActiveDirectoryId string: The ID of the Active Directory to be used for authentication if type is directory-service-authentication.
RootCertificateChainArn string: The ARN of the client certificate. The certificate must be signed by a certificate authority (CA) and it must be provisioned in AWS Certificate Manager (ACM). Only necessary when type is set to certificate-authentication.

Type string: The type of client authentication to be used. Specify certificate-authentication to use certificate-based authentication, or directory-service-authentication to use Active Directory authentication.
ActiveDirectoryId string: The ID of the Active Directory to be used for authentication if type is directory-service-authentication.
RootCertificateChainArn string: The ARN of the client certificate. The certificate must be signed by a certificate authority (CA) and it must be provisioned in AWS Certificate Manager (ACM). Only necessary when type is set to certificate-authentication.

type string: The type of client authentication to be used. Specify certificate-authentication to use certificate-based authentication, or directory-service-authentication to use Active Directory authentication.
activeDirectoryId string: The ID of the Active Directory to be used for authentication if type is directory-service-authentication.
rootCertificateChainArn string: The ARN of the client certificate. The certificate must be signed by a certificate authority (CA) and it must be provisioned in AWS Certificate Manager (ACM). Only necessary when type is set to certificate-authentication.

type str: The type of client authentication to be used. Specify certificate-authentication to use certificate-based authentication, or directory-service-authentication to use Active Directory authentication.
active_directory_id str: The ID of the Active Directory to be used for authentication if type is directory-service-authentication.
rootCertificateChainArn str: The ARN of the client certificate. The certificate must be signed by a certificate authority (CA) and it must be provisioned in AWS Certificate Manager (ACM). Only necessary when type is set to certificate-authentication.

EndpointConnectionLogOptions

See the input and output API doc for this type.

Enabled bool: Indicates whether connection logging is enabled.
CloudwatchLogGroup string: The name of the CloudWatch Logs log group.
CloudwatchLogStream string: The name of the CloudWatch Logs log stream to which the connection data is published.

Enabled bool: Indicates whether connection logging is enabled.
CloudwatchLogGroup string: The name of the CloudWatch Logs log group.
CloudwatchLogStream string: The name of the CloudWatch Logs log stream to which the connection data is published.

enabled boolean: Indicates whether connection logging is enabled.
cloudwatchLogGroup string: The name of the CloudWatch Logs log group.
cloudwatchLogStream string: The name of the CloudWatch Logs log stream to which the connection data is published.

enabled bool: Indicates whether connection logging is enabled.
cloudwatchLogGroup str: The name of the CloudWatch Logs log group.
cloudwatchLogStream str: The name of the CloudWatch Logs log stream to which the connection data is published.

Package Details

Repository: https://github.com/pulumi/pulumi-aws
License: Apache-2.0
Notes: This Pulumi package is based on the aws Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud