Skip to main content

Deploy Access Server on AWS Using CloudFormation from Access Server Hub

Abstract

Deploy OpenVPN Access Server on AWS directly from Access Server Hub using a CloudFormation stack — no manual AMI search required. Covers launching the CloudFormation template, configuring your EC2 instance, and activating your BYOL license key.

Overview

Deploy OpenVPN Access Server on Amazon Web Services (AWS) with an AWS CloudFormation template generated from the Access Server Hub.

This deployment method uses an existing Access Server subscription and creates the required AWS resources in your AWS account. You select your subscription and AWS Region in the Access Server Hub, then launch the preconfigured CloudFormation stack in AWS.

Use this method if you want to:

  • Deploy Access Server into your own AWS VPC

  • Use an Access Server subscription purchased directly from OpenVPN.

  • Automate the creation of the AWS resources required for Access Server.

  • Start the deployment from the Access Server Hub rather than AWS Marketplace.

Note

This deployment path is different from deploying the AWS Marketplace BYOL offering with CloudFormation. For the AWS Marketplace BYOL workflow, refer to AWS BYOL.

Before you begin

Ensure you have:

  • An OpenVPN account with access to the Access Server Hub.

  • An AWS account with permissions to create CloudFormation stacks and the associated AWS resources.

  • An Access Server subscription.

You can use an existing Access Server subscription or purchase one from the Access Server Hub.

🔑 Select your Access Server subscription

  1. Sign in to the Access Server Hub.

  2. From Installation, under AWS Deployment Options, select CloudFormation Script.

  3. Select the Access Server subscription you want to use.

If you don't have an Access Server subscription:

  1. Open Subscriptions in the Access Server Hub.

  2. Select Purchase a New Key.

  3. Select the number of VPN connections you need.

  4. Complete the purchase.

    • The free subscription supports up to two simultaneous VPN connections and doesn't require a paid purchase.

  5. Return to Installation → AWS Deployment Options → CloudFormation Script.

If you have multiple subscriptions, select the appropriate subscription from the dropdown list.

💻 Select the AWS Region and launch CloudFormation

  1. Select Select an AWS region.

  2. Select the AWS Region where you want to deploy Access Server.

  3. Select Launch Now.

    • The Access Server Hub opens AWS CloudFormation and loads the template in the Quick create stack page.

Tip

You can also download the CloudFormation template and launch it manually in AWS instead of selecting Launch Now.

⚙️ Create the CloudFormation stack

AWS opens the Quick create stack page with the CloudFormation template URL and stack description already populated.

Configure stack details

  1. Enter a Stack name. The default is openvpn-accessserver.

  2. Configure the Access Server deployment parameters:

    Configuration

    Details

    Activation key

    The subscription activation key for the Access Server subscription selected in the Access Server Hub. This value is populated automatically.

    Let's Encrypt Certificate

    Select enabled to automatically configure a browser-trusted Let's Encrypt certificate for the Admin Web UI and Client Web UI. Select disabled if you plan to manage the web SSL certificate separately. Access Server will launch with a self-signed certificate.

    Public IP Address Type

    Select an Elastic IP or an AWS Auto-assigned Public IP. We recommend an Elastic IP because it remains unchanged when the instance is stopped and started, helping prevent client disconnections caused by IP address changes.

    VPC ID

    Select the Amazon VPC where Access Server should be deployed.

    Public Subnet ID

    Select the public subnet for the Access Server instance.

    Instance name

    Enter a descriptive name for the Access Server EC2 instance.

    Instance type

    Select an EC2 instance type appropriate for your VPN workload. Refer to System Requirements for sizing guidance.

    EC2 KeyPair for SSH access

    Recommended. Enter the name of an existing EC2 key pair if you want SSH access to the instance. You can find available key pairs under EC2 → Network & Security → Key Pairs. If you leave this field blank, CloudFormation will auto-generate an EC2 key pair.

    Admin password

    Optional. Enter an initial password for the openvpn administrative account. Leave the field blank to have CloudFormation generate a temporary password automatically.

  3. Select Next.

🛡️ Configure permissions and stack options

  1. Configure any additional stack deployment options, validations, or settings required for your environment.

  2. Acknowledge that AWS CloudFormation may create IAM resources.

  3. Select Next.

📜 Review and create the stack

  1. Review the stack configuration.

  2. Confirm the parameters are correct.

  3. Select Submit.

    • AWS begins creating the CloudFormation stack.

    Tip

    If you regularly deploy Access Server with the same configuration, you can use the CloudFormation quick-create option to streamline future deployments.

🕵️‍♂️ Monitor the deployment

The CloudFormation stack displays the deployment timeline and the AWS resources created for Access Server.

  1. Monitor the stack status while AWS creates the resources.

  2. Wait until the stack reports: CREATE_COMPLETE.

  3. Select the Outputs tab.

🔐 Get the Admin Web UI credentials

The CloudFormation outputs provide the information you need to access Access Server for the first time.

  1. Locate:

    Output

    Description

    AdminPortal

    The URL for the Access Server Admin Web UI. The initial URL uses the public IP address assigned to the instance, including the Elastic IP when selected during deployment.

    TempPassword

    The temporary password for the openvpn administrative account when you leave the Admin password parameter blank.

    SSHKeyParameter

    If CloudFormation generated an EC2 key pair, use the corresponding output information for SSH access.

    Important

    After the CloudFormation stack reaches CREATE_COMPLETE, Access Server may require up to five additional minutes to finish system initialization. Sign-in attempts can fail during this period.

  2. Copy the TempPassword, if CloudFormation generated one, and store it securely.

  3. Select the link for the AdminPortal URL.

🔑 Sign in to the Admin Web UI

  1. Open the AdminPortal URL.

  2. Sign in with the openvpn username and the password you configured during deployment or the generated TempPassword.

  3. Review the End User License Agreement (EULA).

  4. Select Agree.

Tip

Because the activation key was supplied through the CloudFormation deployment, Access Server should already be associated with the subscription selected in the Access Server Hub.

💻 Complete first-time setup

The onboarding wizard displays after your first sign-in and guides you through the initial Access Server configuration.

Follow the wizard to:

  • Configure VPN access.

  • Review private networks detected in your AWS VPC.

  • Download OpenVPN Connect.

  • Test your first VPN connection.

For the complete first-time configuration workflow, refer to Get Started with Access Server.

In this section:

The VPN server software, hosted on a Linux operating system.

The portal on the OpenVPN website where you manage your subscriptions, billing, support, and can find Access Server installation instructions.

Access Server's web server used by the administrator to configure the VPN server.

Access Server's web server used by clients to download OpenVPN Connect and configuration profiles.