Authenticating...
Skip to main content

Airbyte MWAA Client VPN — Connection

Overview​

This runbook covers connecting to the airbyte-mwaa-client-vpn-v2 AWS Client VPN endpoint, which provides network access to Airbyte/MWAA resources in the data-engineering-prod AWS account.

Being replaced — check for a SAML endpoint first

The shared-certificate model described below is actively being retired under PLA-352. A standalone SAML / Identity Center Client VPN endpoint for MWAA is already deployed (aws-airflow#299), and the MWAA VPN Users Identity Center group exists and is being populated (aws-organization-management#106).

If you are onboarding a new person, ask the Platform team whether the SAML endpoint is ready for them before handing over the shared .ovpn file — SSO access can be revoked per-user, and the shared cert cannot.

Shared certificate, not per-user

This endpoint uses certificate-based mutual authentication, not SSO/SAML — but there is no per-user certificate. Everyone connects using a copy of the same shared client certificate, embedded in one .ovpn file that gets handed from person to person. Confirmed via Slack history and the underlying Jira ticket — see Prerequisites and Open questions.

Endpoint details​

FieldValue
Endpoint IDcvpn-endpoint-0df399062ff158754
Name/tagairbyte-mwaa-client-vpn-v2
AWS account403739304000 (data-engineering-prod CLI profile)
Regionus-east-2
VPCvpc-0be71819b5cb321e6
Security groupsg-06a706064ef256d3b
Client CIDR10.55.0.0/22
ProtocolOpenVPN (UDP/443), split-tunnel enabled

Prerequisites​

  • The AWS-provided VPN Client software, downloaded directly from aws.amazon.com/vpn/client-vpn-download (Windows/macOS) — or any OpenVPN-compatible client (Tunnelblick, openvpn CLI on Linux) if you'd rather not use the AWS app.
  • A copy of the shared .ovpn file that already has the client cert and key embedded. Ask the Platform team — this is how the last several people actually got connected; there is no per-user cert issuance process. See Open questions.
warning
Handling the shared .ovpn file

The file embeds a live private key that grants network access to a production account, so treat it as a credential:

  • Receive and transfer it only through 1Password (Platform team share link or a shared vault item). Do not accept or forward it any other way.
  • Store it in a protected location on your machine — an OS-permissioned path only you can read (e.g. chmod 600 ~/.config/airbyte-mwaa-vpn.ovpn), never a synced/shared folder — and delete your local copy once you no longer need the connection.
  • Never commit, attach, or paste it (or the .crt/.key extracted from it) into a git repo, Jira/Linear ticket, Slack message, wiki page, screenshot, or any other location outside 1Password.

Because the certificate is shared, one leaked copy means rotating access for everyone — see Admin operations.

The self-service portal does not work for this endpoint

Don't use the self-service portal link (https://self-service.clientvpn.amazonaws.com/endpoints/cvpn-endpoint-0df399062ff158754). Per AWS's docs, the self-service portal is not available for endpoints using mutual (certificate) authentication, which is what this endpoint uses. Get the client software from the generic download page above instead, and get the config file plus cert through steps 1–3 below.

Steps​

Build or renew a profile — administrators only

Steps 1–3 are for administrators assembling or renewing the shared profile, and additionally require AWS console or CLI access to the data-engineering-prod account with permission to view/export Client VPN endpoint config. Ordinary users who already have the shared .ovpn file do not need any AWS access — skip to step 4.

1. Download the base client configuration​

Console: VPC → Client VPN Endpoints → select cvpn-endpoint-0df399062ff158754 → Download client configuration. This gives you a .ovpn file containing the server cert chain and connection settings, but no client identity yet.

In practice nobody assembles this from scratch — everyone asks a teammate for a copy of the already-working file. Steps 1–3 here show how to assemble one from the base pieces, which only matters if you're renewing or reissuing the shared cert yourself (see Where the underlying infrastructure lives).

CLI equivalent:

aws ec2 export-client-vpn-client-configuration \
  --client-vpn-endpoint-id cvpn-endpoint-0df399062ff158754 \
  --profile data-engineering-prod --region us-east-2 \
  --output text > airbyte-mwaa-vpn.ovpn

2. Get the shared client certificate and key​

There's no individual cert-issuance process — ask the Platform team for the shared client certificate (.crt) and its private key (.key). Those two files are all you need to connect, and they're the same ones embedded in the complete .ovpn file mentioned in Prerequisites, so if you already have that file, skip straight to step 4.

The CA private key and its passphrase are restricted to administrators and are not needed to connect — they're only used to sign or reissue client certificates. Don't request them as part of onboarding.

3. Attach the identity to the profile​

Open airbyte-mwaa-vpn.ovpn in a text editor and append the cert and key at the bottom:

<cert>
-----BEGIN CERTIFICATE-----
...contents of the .crt file...
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
...contents of the .key file...
-----END PRIVATE KEY-----
</key>

If you're using the AWS VPN Client app instead, you can import the cert and key as separate files when adding the profile — no manual editing needed.

4. Connect​

  • AWS VPN Client: File → Manage Profiles → Add Profile → point at the profile from step 3 → Connect.
  • OpenVPN CLI: openvpn --config airbyte-mwaa-vpn.ovpn

5. Verify​

  • Confirm you were assigned an IP in 10.55.0.0/22.
  • Confirm you can reach the private Airbyte/MWAA endpoints inside vpc-0be71819b5cb321e6.

6. Disconnect​

Disconnect from the VPN client when you're done — don't leave the tunnel open longer than needed.

FAQ: what about auth-user-pass?​

Don't add it to the .ovpn file. auth-user-pass is an OpenVPN directive for username/password (secondary) authentication — AWS Client VPN only wires that up for endpoints configured with Active Directory or SAML/federated auth. This endpoint uses certificate-only mutual authentication (confirmed via aws ec2 describe-client-vpn-endpoints: a single certificate-authentication entry, no directory-service-authentication or federated-authentication), so there's no username/password backend on the server side to authenticate against. Adding the directive just makes your client prompt for credentials that go nowhere.

If you have a password from 1Password (e.g. "MWAA VPN Passphrase"), that's almost certainly the passphrase protecting the shared client's encrypted private key file, not a login credential. OpenVPN prompts for that automatically when it loads an encrypted .key — it's unrelated to auth-user-pass.

Admin operations (for whoever manages the CA)​

  • Revoking the shared certificate (all users): add the certificate's serial to the CRL, then Actions → Import client certificate CRL on the endpoint. There is only one client certificate, so this cuts off everyone, not one person — see the security implication below. Plan the replacement first: the cert replacement/rotation procedure (easy-rsa → aws acm import-certificate → update vpnProps → CDK deploy) is documented in Jira AI-932 and summarized under Where the underlying infrastructure lives.
  • Exporting the current CRL: Actions → Export client certificate CRL.
  • The CA's passphrase is stored in 1Password (Employee vault, item "MWAA VPN Passphrase") — no accompanying notes on the issuance workflow were found there.

Where the underlying infrastructure lives​

The VPN endpoint, VPC, and certificate ARNs are defined in the AdAction/aws-airflow repo — specifically lib/app/vpc-stack.ts (the configureVpn method) and bin/aws-cdk-mwaa.ts (the vpnProps for the production config). Confirmed via Jira AI-932, which documents the full cert-renewal process (easy-rsa → aws acm import-certificate → update vpnProps → CDK deploy). That ticket is Done (resolved ~2026-05-20) — the airbyte-mwaa-client-vpn-v2 endpoint (created 2026-01-15) is very likely the output of that renewal work, replacing the endpoint whose certs expired 2025-12-17.

Open questions​

Updated 2026-08-12 from Slack, Jira, and Linear history.

  • Is the AWS Identity Center group "VPN Users" relevant to this endpoint? Resolved: no — leftover from an abandoned Aug 2024 SSO migration attempt (see this thread). Not wired into current authentication. The replacement group under PLA-352 is MWAA VPN Users.
  • Who issues client certs, and how? Resolved, and worse than assumed: nobody issues individual certs. There is one shared client certificate for the whole endpoint (see AI-932), embedded in a single .ovpn file manually copied from person to person.
  • Security/ops implication: because it's a shared credential, nobody can revoke a single person's access without rotating the cert for everyone. This is why access couldn't be cleanly removed for two departing users in Aug 2024, and the reason PLA-352 exists.
  • Where's the IaC for the VPC/VPN endpoint? Resolved: AdAction/aws-airflow, lib/app/vpc-stack.ts + bin/aws-cdk-mwaa.ts (per AI-932).
  • Certs have expired unnoticed twice now (2023, and Dec 2025 per AI-932) with no monitoring in place — still open, worth an expiry alert.
  • Is the separate untagged endpoint (cvpn-endpoint-036d4526e8aeff875) still in use, or fully replaced by -v2? Still open.