Can I use an AWS Client VPN endpoint to access more than three subnets in the same region?

Question

My VPC is in eu-west-2. I have two su.nets for an RDS instance, split across two different availability zones for reasons of high availability: eu-west-2a and eu-west-2b. I also have a Redshift cluster in its own su.net in eu-west-2c.

With this configuration, I have successfully configured an AWS Client VPN endpoint so that I can access RDS and Redshift from my local machine when connected to a VPN client with the appropriate configuration.

While following the same principles of using su.nets for specific services, I would like my EC2 instances to live in private su.nets that are also only accessible over a VPN connection. However, one of the limitations of the Client VPN service is:

You cannot associate multiple su.nets from the same Availability Zone with a Client VPN endpoint.

This implies that I would need to create a separate endpoint for connecting to my private EC2 su.net—which feels like complete overkill for my modest.networking architecture!

Is there a workaround?

Answer 1

By default, a su.net can reach the other su.nets.

This means that you won't need to do anything. This will work out of the box. If not, check the route tables and see if there is a route from your VPN su.net to your private su.net.

Answer 2

When you associate the first su.net with the Client VPN endpoint, the following happens:

• The state of the Client VPN endpoint changes to available. Clients can now establish a VPN connection, but they cannot access any resources in the VPC until you add the authorization rules.

• The local route of the VPC is automatically added to the Client VPN endpoint route table. (This local route allows you to communicate with every su.net within the VPC that the su.net is in.)

• The VPC's default security group is automatically applied for the Client VPN endpoint.

See documentation for details.