AWS SSO VPN accessing VPC in another Account

Hi there,

I have 2 AWS Accounts:

I've created a Client VPN Endpoint application in Management (SSO).

I have few users in SSO (Management) that need to access an EKS Cluster in Dev account.

My Client VPN needs to associate with private subnets in another account.

I see 2 possible solutions:

Does anyone have another option?

Or tell me which of the two could be the best.

Topics

Tags

Language

English

asked 3 months ago276 views

2 Answers

Accepted Answer

You should keep your management account as empty as possible.

I would deploy a central AWS Network account and VPN into there and then either use transit gateway or VPC peering to dev.

EXPERT

answered 3 months ago

Emmanuel
3 months ago
Agree, but in this case I'm not able to use VPN on SSO, right?
Gary Mclean EXPERT
3 months ago
No that’s not correct. You can still have SSO on the VPN
Gary Mclean EXPERT
3 months ago
In the network account in IAM you setup an IDP pointing to your SSO and then the vpn client is configured to use the IDP in iam and it all works. I’ve set this up before with azure AD SSO. What’s your SSO provider?

Hi Gary,

Sorry for late and thanks for helping!

I'm using AWS SSO.

I've created a Networking Account and Shared the Private Subnets with MGMT Account via RAM.

Now I'm using the VPN in MGMT account (with SSO) accessing the EKS Cluster (private).

answered 3 months ago

Emmanuel
3 months ago
I'll try to follow your recommendation and move the VPN to the Networking Account and setup an IDP in this account authenticating with the MGMT SSO.
Gary Mclean EXPERT
3 months ago
No worries you should keep your management account as empty as possible and use workload accounts for things such as eks and network account for networking stuff. It follows AWS SRA. Transit gateway is great for your use case but does cost to run it. Any questions please just shout.

Relevant content