---
title: Deploy Access Server on AWS Using CloudFormation from Access Server Hub
canonical: https://openvpn.net/as-docs/v3/aws-cloudformation/
product: Access Server Docs
description: Deploy OpenVPN Access Server on AWS directly from Access Server Hub using a CloudFormation stack — no manual AMI search required. Covers launching the CloudFormation template, configuring your EC2 instance, and activating your BYOL license key.
---

# Deploy Access Server on AWS Using CloudFormation from Access Server Hub

## Overview

Deploy OpenVPN Access Server on Amazon Web Services (AWS) with an [AWS CloudFormation template](https://as-portal.openvpn.com/instructions/aws/installation?system=cloud-launcher) generated from the Access Server Hub.

This deployment method uses an existing Access Server subscription and creates the required AWS resources in your AWS account. You select your subscription and AWS Region in the Access Server Hub, then launch the preconfigured CloudFormation stack in AWS.

Use this method if you want to:

- Deploy Access Server into your own AWS VPC
- Use an Access Server subscription purchased directly from OpenVPN.
- Automate the creation of the AWS resources required for Access Server.
- Start the deployment from the Access Server Hub rather than AWS Marketplace.

> **Note**
>
> This deployment path is different from deploying the AWS Marketplace BYOL offering with CloudFormation. For the AWS Marketplace BYOL workflow, refer to [AWS BYOL](https://openvpn.net/as-docs/v3/aws-byol.md).

## Before you begin

Ensure you have:

- An OpenVPN account with access to the [Access Server Hub](https://as-portal.openvpn.com/).
- An AWS account with permissions to create CloudFormation stacks and the associated AWS resources.
- An Access Server [subscription](https://openvpn.net/as-docs/v3/activate-a-subscription.md).

You can use an existing Access Server subscription or purchase one from the Access Server Hub.

## 🔑 Select your Access Server subscription

1. Sign in to the [Access Server Hub](https://as-portal.openvpn.com/).
2. From **Installation**, under **AWS Deployment Options**, select **CloudFormation Script**.
3. Select the Access Server subscription you want to use.

If you don't have an Access Server subscription:

1. Open **Subscriptions** in the Access Server Hub.
2. Select **Purchase a New Key**.
3. Select the number of VPN connections you need.
4. Complete the purchase.
   - The free subscription supports up to two simultaneous VPN connections and doesn't require a paid purchase.
5. Return to **Installation → AWS Deployment Options → CloudFormation Script**.

If you have multiple subscriptions, select the appropriate subscription from the dropdown list.

## 💻 Select the AWS Region and launch CloudFormation

1. Select **Select an AWS region**.
2. Select the AWS Region where you want to deploy Access Server.
3. Select **Launch Now**.
   - The Access Server Hub opens AWS CloudFormation and loads the template in the **Quick create stack** page.

> **Tip**
>
> You can also download the CloudFormation template and launch it manually in AWS instead of selecting **Launch Now**.

## ⚙️ Create the CloudFormation stack

AWS opens the **Quick create stack** page with the CloudFormation template URL and stack description already populated.

### Configure stack details

1. Enter a **Stack name**. The default is `openvpn-accessserver`.
2. Configure the Access Server deployment parameters:

   | **Configuration** | **Details** |
   | --- | --- |
   | **Activation key** | The subscription activation key for the Access Server subscription selected in the Access Server Hub. This value is populated automatically. |
   | **Let's Encrypt Certificate** | Select **enabled** to automatically configure a browser-trusted Let's Encrypt certificate for the Admin Web UI and Client Web UI. Select **disabled** if you plan to manage the web SSL certificate separately. Access Server will launch with a self-signed certificate. |
   | **Public IP Address Type** | Select an **Elastic IP** or an AWS **Auto-assigned Public IP**. We recommend an Elastic IP because it remains unchanged when the instance is stopped and started, helping prevent client disconnections caused by IP address changes. |
   | **VPC ID** | Select the Amazon VPC where Access Server should be deployed. |
   | **Public Subnet ID** | Select the public subnet for the Access Server instance. |
   | **Instance name** | Enter a descriptive name for the Access Server EC2 instance. |
   | **Instance type** | Select an EC2 instance type appropriate for your VPN workload. Refer to [System Requirements](https://openvpn.net/as-docs/v3/system-requirements.md) for sizing guidance. |
   | **EC2 KeyPair for SSH access** | Recommended. Enter the name of an existing EC2 key pair if you want SSH access to the instance. You can find available key pairs under **EC2 → Network & Security → Key Pairs**. If you leave this field blank, CloudFormation will auto-generate an EC2 key pair. |
   | **Admin password** | Optional. Enter an initial password for the `openvpn` administrative account. Leave the field blank to have CloudFormation generate a temporary password automatically. |
3. Select **Next**.

### 🛡️ Configure permissions and stack options

1. Configure any additional stack deployment options, validations, or settings required for your environment.
2. Acknowledge that AWS CloudFormation may create IAM resources.
3. Select **Next**.

### 📜 Review and create the stack

1. Review the stack configuration.
2. Confirm the parameters are correct.
3. Select **Submit**.
   - AWS begins creating the CloudFormation stack.

   > **Tip**
   >
   > If you regularly deploy Access Server with the same configuration, you can use the CloudFormation quick-create option to streamline future deployments.

## 🕵️‍♂️ Monitor the deployment

The CloudFormation stack displays the deployment timeline and the AWS resources created for Access Server.

1. Monitor the stack status while AWS creates the resources.
2. Wait until the stack reports: `CREATE_COMPLETE`.
3. Select the **Outputs** tab.

## 🔐 Get the Admin Web UI credentials

The CloudFormation outputs provide the information you need to access Access Server for the first time.

1. Locate:

   | **Output** | **Description** |
   | --- | --- |
   | **AdminPortal** | The URL for the Access Server Admin Web UI. The initial URL uses the public IP address assigned to the instance, including the Elastic IP when selected during deployment. |
   | **TempPassword** | The temporary password for the `openvpn` administrative account when you leave the Admin password parameter blank. |
   | **SSHKeyParameter** | If CloudFormation generated an EC2 key pair, use the corresponding output information for SSH access. |

   > **Important**
   >
   > After the CloudFormation stack reaches `CREATE_COMPLETE`, Access Server may require up to five additional minutes to finish system initialization. Sign-in attempts can fail during this period.
2. Copy the **TempPassword**, if CloudFormation generated one, and store it securely.
3. Select the link for the **AdminPortal** URL.

## 🔑 Sign in to the Admin Web UI

1. Open the **AdminPortal** URL.
2. Sign in with the `openvpn` username and the password you configured during deployment or the generated **TempPassword**.
3. Review the End User License Agreement (EULA).
4. Select **Agree**.

> **Tip**
>
> Because the activation key was supplied through the CloudFormation deployment, Access Server should already be associated with the subscription selected in the Access Server Hub.

## 💻 Complete first-time setup

The onboarding wizard displays after your first sign-in and guides you through the initial Access Server configuration.

Follow the wizard to:

- Configure VPN access.
- Review private networks detected in your AWS VPC.
- Download OpenVPN Connect.
- Test your first VPN connection.

For the complete first-time configuration workflow, refer to [Get Started with Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--access-server-install-and-set-up.md).

---

Prev: [AWS](https://openvpn.net/as-docs/v3/aws.md)
Next: [AWS BYOL](https://openvpn.net/as-docs/v3/aws-byol.md)
Index: https://openvpn.net/as-docs/llms.txt