AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
AWS Client VPN maximum VPN session duration
According to the AWS documentation, the AWS Client VPN Session timeout will force a tunnel to disconnect and only under certain circumstances it will reconnect as per the following:-
AWS Client VPN provides several options for the maximum VPN session duration, which is the maximum time allowed for a client connection to the Client VPN endpoint. You can configure a shorter maximum VPN session duration to help meet security and compliance requirements. By default, the maximum VPN session duration is 24 hours. After session timeout expiry, a new session is automatically established in the case of cached user credentials (Active Directory) or certificate-based authentication (Mutual Authentication). To fully disconnect and not automatically reconnect, these users should manually disconnect. A new session is not automatically established in the case of federated authentication (SAML), so these users must authenticate again after session timeout expiry to establish the VPN connection.
This is using EntraID Enterprise Application for AWS Client VPN
However, we have seen that SAML authenticated users are still automatically reconnecting when we have the max duration set at 8 hours. Any ideas how to stop SAML users re-authenticating and establishing a new tunnel as users do not manually disconnect and during the night when people are asleep, their VPN tunnel is still active accumulating charges?
https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/cvpn-working-max-duration.html
- Language
- English
- Newest
- Most votes
- Most comments
The behavior you're experiencing with SAML-authenticated users automatically reconnecting after the 8-hour maximum session duration is not consistent with the expected behavior described in the AWS documentation. According to the information provided, SAML-authenticated users should not automatically reconnect after the session timeout expiry.
To address this issue and prevent SAML users from re-authenticating and establishing new tunnels automatically, especially during inactive periods like nighttime, you could consider the following approaches:
-
Verify the configuration: Double-check that the Client VPN endpoint is correctly configured for SAML-based authentication and that the maximum session duration is indeed set to 8 hours.
-
Client-side settings: Ensure that the AWS provided client or any third-party OpenVPN compatible client being used is not configured to automatically reconnect. Some client applications may have built-in reconnection features that could override the server-side settings.
-
Monitor and audit: Use Amazon CloudWatch Logs to monitor connection attempts and session durations. This can help you identify any unexpected behavior and gather more information about when and how these reconnections are occurring.
-
Contact AWS Support: If you've verified your configuration and are still experiencing this unexpected behavior, it may be worth contacting AWS Support to investigate further, as this could potentially be a bug or an undocumented behavior of the service.
Remember, the goal of setting a maximum session duration is to enhance security and control access. If users' sessions are remaining active when they're not actually using the VPN, it defeats the purpose of this security measure and, as you noted, can lead to unnecessary charges.
Sources
AWS Client VPN maximum VPN session duration - AWS Client VPN
Client authentication in AWS Client VPN - AWS Client VPN
AWS VPN | Features | Amazon Web Services (AWS)
answered 2 years ago
It's been 4 days since Amazon Web Service's network has been unstable, and how do I report it to their network team?
answered a year ago
Relevant content
asked 6 years ago
asked 4 years ago
- AWS OFFICIALUpdated 3 years ago
- AWS OFFICIALUpdated 5 months ago
- AWS OFFICIALUpdated 3 years ago
