AWS vpn high security documentation change
Summary
Added VPN client usage recommendations and enforced cryptographic algorithms for TLS and data channels
Security assessment
Explicitly mandates secure configurations by prohibiting cipher/TLS modifications and specifying approved cryptographic algorithms (TLS 1.3/1.2 protocols and AES-256-GCM), directly addressing cryptographic security
Diff
diff --git a/vpn/latest/clientvpn-admin/security-best-practices.md b/vpn/latest/clientvpn-admin/security-best-practices.md index 4bfea3bea..647173393 100644 --- a//vpn/latest/clientvpn-admin/security-best-practices.md +++ b//vpn/latest/clientvpn-admin/security-best-practices.md @@ -34,0 +35,17 @@ Manage access to Client VPN resources and APIs by using IAM policies for your IA +###### Use the AWS provided VPN client + +Use the AWS provided client for AWS Client VPN, available from the [AWS Client VPN download page](https://aws.amazon.com/vpn/client-vpn-download/). + +###### Use the exported client configuration + +Use the client configuration file exported from your AWS Client VPN endpoint. For more information, see [Export the client configuration file](./export-client-config-file.html). Do not modify the cipher or TLS settings in the configuration file. AWS Client VPN endpoints only support the following algorithms: + + * TLS 1.3: `TLS_AES_256_GCM_SHA384` and `TLS_AES_128_GCM_SHA256` + + * TLS 1.2: `TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384`, `TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256`, `TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384`, and `TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256` + + * Data channel: `AES-256-GCM` + + + +