Usando AWS re:Post, accetti AWS re:Post Termini di utilizzo
AWS re:Postre:Post

AWS SSO VPN accessing VPC in another Account

0

Hi there,

I have 2 AWS Accounts:

  • Management (with SSO Enabled)
  • Dev (with EKS)

I've created a Client VPN Endpoint application in Management (SSO).

I have few users in SSO (Management) that need to access an EKS Cluster in Dev account.

My Client VPN needs to associate with private subnets in another account.

I see 2 possible solutions:

  • create a new VPC in Management and peer with EKS VPC (Dev)
  • create a VPN in Dev using mutual authentication

Does anyone have another option?

Or tell me which of the two could be the best.

Argomenti
Networking e distribuzione di contenutiGestione e amministrazione
Tag
Amazon VPCGestore account AWSVPN per clienti AWS
Lingua
English
Emmanuel
posta 4 mesi fa293 visualizzazioni
2 Risposte
1
Risposta accettata

You should keep your management account as empty as possible.

I would deploy a central AWS Network account and VPN into there and then either use transit gateway or VPC peering to dev.

profile picture
ESPERTO
Gary Mclean
con risposta 4 mesi fa
  • Emmanuel
    4 mesi fa

    Agree, but in this case I'm not able to use VPN on SSO, right?

  • Gary Mclean ESPERTO
    4 mesi fa

    No that’s not correct. You can still have SSO on the VPN

  • Gary Mclean ESPERTO
    4 mesi fa

    In the network account in IAM you setup an IDP pointing to your SSO and then the vpn client is configured to use the IDP in iam and it all works. I’ve set this up before with azure AD SSO. What’s your SSO provider?

0

Hi Gary,

Sorry for late and thanks for helping!

I'm using AWS SSO.

I've created a Networking Account and Shared the Private Subnets with MGMT Account via RAM.

Now I'm using the VPN in MGMT account (with SSO) accessing the EKS Cluster (private).

Emmanuel
con risposta 4 mesi fa
  • Emmanuel
    4 mesi fa

    I'll try to follow your recommendation and move the VPN to the Networking Account and setup an IDP in this account authenticating with the MGMT SSO.

  • Gary Mclean ESPERTO
    4 mesi fa

    No worries you should keep your management account as empty as possible and use workload accounts for things such as eks and network account for networking stuff. It follows AWS SRA. Transit gateway is great for your use case but does cost to run it. Any questions please just shout.

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande

Contenuto pertinente