Endpoint
Provides an AWS Client VPN endpoint for OpenVPN clients. For more information on usage, please see the AWS Client VPN Administrator's Guide.
NOTE on Client VPN endpoint target network security groups: this provider provides both a standalone Client VPN endpoint network association resource with a (deprecated)
security_groupsargument and a Client VPN endpoint resource with asecurity_group_idsargument. Do not specify security groups in both resources. Doing so will cause a conflict and will overwrite the target network security group association.
Example Usage
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.ec2clientvpn.Endpoint;
import com.pulumi.aws.ec2clientvpn.EndpointArgs;
import com.pulumi.aws.ec2clientvpn.inputs.EndpointAuthenticationOptionArgs;
import com.pulumi.aws.ec2clientvpn.inputs.EndpointConnectionLogOptionsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new Endpoint("example", EndpointArgs.builder()
.description("clientvpn-example")
.serverCertificateArn(aws_acm_certificate.cert().arn())
.clientCidrBlock("10.0.0.0/16")
.authenticationOptions(EndpointAuthenticationOptionArgs.builder()
.type("certificate-authentication")
.rootCertificateChainArn(aws_acm_certificate.root_cert().arn())
.build())
.connectionLogOptions(EndpointConnectionLogOptionsArgs.builder()
.enabled(true)
.cloudwatchLogGroup(aws_cloudwatch_log_group.lg().name())
.cloudwatchLogStream(aws_cloudwatch_log_stream.ls().name())
.build())
.build());
}
}Import
AWS Client VPN endpoints can be imported using the id value found via aws ec2 describe-client-vpn-endpoints, e.g.,
$ pulumi import aws:ec2clientvpn/endpoint:Endpoint example cvpn-endpoint-0ac3a1abbccddd666Constructors
Functions
Properties
The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater.