Hi all,

We are migrating from legacy remote access solution to AWS VPN Client solution, and we have come across some architectural challenges.

I was wondering if someone maybe came across challenges or knows what direction I should look.

At the moment we are using OpenVPN as our remote access solution to access resources in AWS accounts. We have an OpenVPN server hosted in private subnet that end users can access using OpenVPN clients on MacOS, Windows and iOS devices.

To improve our security, we made a decision to migrate our remote access solution to AWS VPN Client. This will allow us to use our existing Azure Active Directory as authentication and authorization backend by using AzureAD as SAML Identity Provider for AWS VPN Client.

Users will be able to install AWS VPN Client on their devices, login to AWS VPN Client endpoint and then login using Azure AD including MFA.

This has been working smoothly for both MacOS and Windows devices. However we also have several developers that work on creating mobile applications and they have a requirement to use iOS device to connect via VPN.

Unfortunately, AWS VPN Client is not available for iOS devices. It is possible to use OpenVPN Client on iOS to login to AWS VPN Client endpoint, however SAML Authentication is not supported for this scenario. We have already enquired about this issue with AWS Support and we had a confirmation that SAML federation is not supported when using iOS.

This means we can’t use SAML and we are left with two other options for authentication for this scenario :

Mutual authentication with certificates. This solution assumes distribution of certificates to the clients. While this may work, this is suboptimal for us as this assumes that joiners and leavers procedures will need to be duplicated as separate set of credentials would be used.

AWS Managed AD or AD Connector. If we can synchronize subset of AWS Managed AD from the our current Azure AD , that would suit us perfect as this would mean we still have one identity store.

The questions I have is related to the second solution, i.e using AWS Managed AD.

Is it possible to have identities sync between Azure AD Managed AD and Azure AD? I could not find any guides or examples for this scenarios. Most examples are describing on prem or EC2 based AD sync using AD Connect or Azure Passthrough authentication, none of these apply to our case.

If this is not possible, what are the possible ways to solve our problem to ensure we don’t have a separate identity store like I described for the case with mutual authentication?