// Module included in the following assemblies:
//
// * osd_cluster_admin/osd_private_connections/aws-private-connections.adoc

:_mod-docs-content-type: PROCEDURE
[id="aws-vpn_{context}"]
= Configure an AWS Virtual Private Network

[role="_abstract"]
Configure an AWS Site-to-Site Virtual Private Network (VPN) connection to enable secure communication between your {product-title} cluster Virtual Private Cloud (VPC) and your remote on-site network.

[NOTE]
====
AWS VPN does not currently provide a managed option to apply Network Address Translation (NAT) to VPN traffic. See the link:https://aws.amazon.com/premiumsupport/knowledge-center/configure-nat-for-vpn-traffic/[AWS Knowledge Center] for more details.

Routing all traffic, for example `0.0.0.0/0`, through a private connection is not supported. This requires deleting the internet gateway, which disables SRE management traffic.
====

.Prerequisites

* Hardware VPN gateway device model and software version, for example Cisco Adaptive Security Appliance (ASA) running version 8.3. See the link:https://docs.aws.amazon.com/vpc/latest/adminguide/Introduction.html#DevicesTested[AWS documentation] to confirm whether your gateway device is supported by AWS.
* Public, static IP address for the VPN gateway device.
* Border Gateway Protocol (BGP) or static routing: if BGP, the Autonomous System Number (ASN) is available. If static routing, at least one static route is configured.
* Optional: Internet Protocol (IP) address and port/protocol of a reachable service to test the VPN connection.

.Procedure

. link:https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html#vpn-create-cgw[Create a customer gateway] to configure the VPN connection.

. If you do not already have a Virtual Private Gateway attached to the intended VPC, link:https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html#vpn-create-target-gateway[create and attach] a Virtual Private Gateway.

. link:https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html#vpn-configure-route-tables[Configure routing and enable VPN route propagation].

. link:https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html#vpn-configure-security-groups[Update your security group].

. link:https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html#vpn-create-vpn-connection[Establish the Site-to-Site VPN connection].
+
[NOTE]
====
Note the VPC subnet information, which you must add to your configuration as the remote network.
====

[role="_additional-resources"]
.Additional resources

* link:https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html[AWS VPN guide]
