Terraform for creating AWS Client VPN

aws-client-vpn.tf

# source: https://spak.no/blog/article/63f519260faeadeeeb968af2

# good resource: https://spak.no/blog/article/63f519260faeadeeeb968af2

# generating PKI certs using easyrsa: https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/mutual.html

resource "aws_acm_certificate" "server_vpn_cert" {
  certificate_body  = file("pki/server.crt")
  private_key       = file("pki/server.key")
  certificate_chain = file("pki/ca.crt")
}

resource "aws_acm_certificate" "client_vpn_cert" {
  certificate_body  = file("pki/client1.domain.tld.crt")
  private_key       = file("pki/client1.domain.tld.key")
  certificate_chain = file("pki/ca.crt")
}

resource "aws_security_group" "vpn_secgroup" {
  name   = "ecm-vpn-${var.environment_name}"
  vpc_id = aws_vpc.cms_content_delivery_vpc.id
  description = "Allow inbound traffic from port 443, to the VPN"
 
  ingress {
   protocol         = "tcp"
   from_port        = 443
   to_port          = 443
   cidr_blocks      = [var.ec2_bastion_cidrs]
  }
 
  egress {
   protocol         = "-1"
   from_port        = 0
   to_port          = 0
   cidr_blocks      = ["0.0.0.0/0"]
  }
}

resource "aws_ec2_client_vpn_endpoint" "my_client_vpn" {
  description            = "ECM VPN endpoint ${var.environment_name}"
  server_certificate_arn = aws_acm_certificate.server_vpn_cert.arn
  client_cidr_block      = "10.100.0.0/22"
  vpc_id                 = aws_vpc.cms_content_delivery_vpc.id
  
  security_group_ids     = [aws_security_group.vpn_secgroup.id]
  split_tunnel           = true

  # Client authentication
  authentication_options {
    type                       = "certificate-authentication"
    root_certificate_chain_arn = aws_acm_certificate.client_vpn_cert.arn
  }

  connection_log_options {
    enabled = false
   }

  depends_on = [
    aws_acm_certificate.server_vpn_cert,
    aws_acm_certificate.client_vpn_cert
  ]
}

resource "aws_ec2_client_vpn_network_association" "client_vpn_association_private" {
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.my_client_vpn.id
  subnet_id              =  aws_subnet.subnet_a.id
}

# can't have two endpoints in the same AZ
#resource "aws_ec2_client_vpn_network_association" "client_vpn_association_public_a" {
#  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.my_client_vpn.id
#  subnet_id              =  aws_subnet.ecm_public_a.id
#}

resource "aws_ec2_client_vpn_network_association" "client_vpn_association_public_c" {
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.my_client_vpn.id
  subnet_id              =  aws_subnet.ecm_public_c.id
}

resource "aws_ec2_client_vpn_authorization_rule" "authorization_rule" {
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.my_client_vpn.id
  
  target_network_cidr    = "10.0.0.0/16"
  authorize_all_groups   = true
}