OpenVPN is a popular and respected solution for enabling remote access to AWS VPCs for IT personnel, cloud developers, and a wide variety of end-user roles. While OpenVPN may be all that is needed to enable cloud access for a few users, it alone cannot meet the needs of growing organizations, particularly those that have security or compliance requirements. Similarly, Bastion hosts or jump hosts are often used when AWS is primarily focused on developers, but these tools likewise have scaling and security limitations.

1. Secure Remote Access to AWS
Why OpenVPN & Jump Hosts Aren’t Enough
AWS Bootcamp #5 – April 12, 2018
Sherry Wei, Founder & CTO
Neel Kamal, Head of Field Operations
Frank Cabri, VP Product Marketing

2. © 2018 AVIATRIX SYSTEMS, INC . | 2
• Why Remote Access for AWS?
• Capabilities to Consider
• Understanding your Options
• Demo
• Live Q & A
Welcome & Agenda
SHERRY WEI
Founder & CTO
NEEL KAMAL
Head of Field Operations
FEATURED SPEAKERS

3. © 2018 AVIATRIX SYSTEMS, INC . | 3
Check Out More Bootcamps – Available On-Demand
www.aviatrix.com/bootcamps

4. © 2018 AVIATRIX SYSTEMS, INC . | 4
Remote Access for AWS – A Question of “When” Not “If”
When workloads move to the cloud, all users are “remote,” whether employees, partners or contractors

5. © 2018 AVIATRIX SYSTEMS, INC . | 5
What is Remote Access?
- SSL-based VPN access to private resources in VPCs in public cloud
Who Needs Remote Access?
- Priority: Cloud Ops needing direct access for troubleshooting all resources
- Priority: Developer access into dev/QA/staging
- Priority: Partners/contractors who are doing development, operations, support
- Maybe: Employee access to internal apps
Why Is It Important?
- Remote access security (authentication, authorization, auditing) is your
responsibility
- Directly impacts employee productivity
Why Do I Need a Remote Access Solution?

6. © 2018 AVIATRIX SYSTEMS, INC . | 6
Authentication
- Active Directory, LDAP, Okta, Duo
- SAML IDP (Okta, Google, Centrify, Forgerock, etc.)
Fine-Grained Authorization Control
- User-based access control for VPC resources
Scalability
- Scale up/down/out your VPN server based on your load
- Geo scale based on distribution of your workforce
Multi-Cloud & Multi-VPC Support
- Amazon Web Services, Microsoft Azure, Google Cloud
Monitoring and Logging
- Extensive user activity logging for audit and compliance
Centralized Management
- Centralized portal to manage VPN users and policies
Criteria for Choosing a Solution for Remote Access to AWS

7. © 2018 AVIATRIX SYSTEMS, INC . | 7
Understanding Remote Access Options for AWS
2. OpenVPN Access
Server
3. AWS Cloud-Native VPN
1. Bastion Host / Jump
Host
EmployeesDevelopers and Ops Teams

8. © 2018 AVIATRIX SYSTEMS, INC . | 8
How It Works
- Step 1: Install & configure a bastion host in every VPC
- Step 2: Manage users on each bastion host
- Step 3: Generate and distribute private keys to end users
- Automation: mostly manual or script-based
Recommended Use Cases
- Small group (fewer than 10 users)
- Small number of VPCs or VNETs (fewer than 5)
- Used mostly by in-house developers or operations teams
What’s Missing
(1) Centralized management (2) Monitoring and logging (3)
Scalability (4) Fine-grained authorization control
Option #1 | Bastion Hosts & Jump Hosts

9. © 2018 AVIATRIX SYSTEMS, INC . | 9
How It Works
- Step 1: Launch Access Server in a central VPC
- Step 2: Connect spoke VPCs to the central VPCs
- Step 3: Build integration with authentication sources
- Step 4: Generate and distribute certificates to end users
- Automation: some automation, but still requires heavy management and
operations
Recommended Use Cases
- Small number of VPCs or VNETs (fewer than 5)
- Used mostly by in-house developers or operations teams
What’s Missing
(1) Can’t scale out (2) Fine-grained authorization control (3) Centralized
management
Option #2 | OpenVPN® Access Server

10. © 2018 AVIATRIX SYSTEMS, INC . | 10
How It Works
- Step 1: Launch Controller AMI in AWS
- Step 2: Use wizard for user VPN setup
- Step 3: Generate & distribute user
certificates
Recommended Use Cases
- Cloud scale for global workforce
- Multiple VPCs and/or multi-regions
- Large number of users
- MFA, IDaaS and profile-based access
- Regulatory requirements (logging etc)
What’s Missing
- Cloud VPN only
Option #3 | AWS Cloud-Native VPN

11. © 2018 AVIATRIX SYSTEMS, INC . | 11
• For a free trial of Aviatrix for User VPN,
go to …
https://www.aviatrix.com
… and use the Start Now button
• You’ll receive email w/ a link to a replay
and slides
• Review product features:
https://www.aviatrix.com/user-vpn
• To view other bootcamps:
https://www.aviatrix.com/bootcamps
Next Steps with Aviatrix

12. Thank You