AWS SSO VPN accessing VPC in another Account

Question

Hi there,

I have 2 AWS Accounts:
- Management (with SSO Enabled)
- Dev (with EKS)

I've created a Client VPN Endpoint application in Management (SSO).

I have few users in SSO (Management) that need to access an EKS Cluster in Dev account.

My Client VPN needs to associate with private subnets in another account.

I see 2 possible solutions:
- create a new VPC  in Management and peer with EKS VPC (Dev)
- create a VPN in Dev using mutual authentication

Does anyone have another option?

Or tell me which of the two could be the best.

Accepted Answer

You should keep your management account as empty as possible.

I would deploy a central AWS Network account and VPN into there and then either use transit gateway or VPC peering to dev.

Answer

Hi Gary,

Sorry for late and thanks for helping!

I'm using AWS SSO.

I've created a Networking Account and Shared the Private Subnets with MGMT Account via RAM.

Now I'm using the VPN in MGMT account (with SSO) accessing the EKS Cluster (private).

相關內容