Deploy Access Server on AWS Using CloudFormation from Access Server Hub⁠

Overview⁠

Deploy OpenVPN Access Server on Amazon Web Services (AWS) with an AWS CloudFormation template generated from the Access Server Hub.

This deployment method uses an existing Access Server subscription and creates the required AWS resources in your AWS account. You select your subscription and AWS Region in the Access Server Hub, then launch the preconfigured CloudFormation stack in AWS.

Use this method if you want to:

Deploy Access Server into your own AWS VPC
Use an Access Server subscription purchased directly from OpenVPN.
Automate the creation of the AWS resources required for Access Server.
Start the deployment from the Access Server Hub rather than AWS Marketplace.

Before you begin⁠

Ensure you have:

An OpenVPN account with access to the Access Server Hub.
An AWS account with permissions to create CloudFormation stacks and the associated AWS resources.
An Access Server subscription.

You can use an existing Access Server subscription or purchase one from the Access Server Hub.

Sign in to the Access Server Hub.
From Installation, under AWS Deployment Options, select CloudFormation Script.
Select the Access Server subscription you want to use.

If you don't have an Access Server subscription:

Open Subscriptions in the Access Server Hub.
Select Purchase a New Key.
Select the number of VPN connections you need.
Complete the purchase.
- The free subscription supports up to two simultaneous VPN connections and doesn't require a paid purchase.
Return to Installation → AWS Deployment Options → CloudFormation Script.

If you have multiple subscriptions, select the appropriate subscription from the dropdown list.

AWS opens the Quick create stack page with the CloudFormation template URL and stack description already populated.

Configure stack details⁠

Enter a Stack name. The default is openvpn-accessserver.

Configure the Access Server deployment parameters:

Configuration	Details
Activation key	The subscription activation key for the Access Server subscription selected in the Access Server Hub. This value is populated automatically.
Let's Encrypt Certificate	Select enabled to automatically configure a browser-trusted Let's Encrypt certificate for the Admin Web UI and Client Web UI. Select disabled if you plan to manage the web SSL certificate separately. Access Server will launch with a self-signed certificate.
Public IP Address Type	Select an Elastic IP or an AWS Auto-assigned Public IP. We recommend an Elastic IP because it remains unchanged when the instance is stopped and started, helping prevent client disconnections caused by IP address changes.
VPC ID	Select the Amazon VPC where Access Server should be deployed.
Public Subnet ID	Select the public subnet for the Access Server instance.
Instance name	Enter a descriptive name for the Access Server EC2 instance.
Instance type	Select an EC2 instance type appropriate for your VPN workload. Refer to System Requirements for sizing guidance.
EC2 KeyPair for SSH access	Recommended. Enter the name of an existing EC2 key pair if you want SSH access to the instance. You can find available key pairs under EC2 → Network & Security → Key Pairs. If you leave this field blank, CloudFormation will auto-generate an EC2 key pair.
Admin password	Optional. Enter an initial password for the `openvpn` administrative account. Leave the field blank to have CloudFormation generate a temporary password automatically.

Select Next.

🛡️ Configure permissions and stack options⁠

Configure any additional stack deployment options, validations, or settings required for your environment.
Acknowledge that AWS CloudFormation may create IAM resources.
Select Next.

📜 Review and create the stack⁠

Review the stack configuration.
Confirm the parameters are correct.
Select Submit.
- AWS begins creating the CloudFormation stack.
Tip
If you regularly deploy Access Server with the same configuration, you can use the CloudFormation quick-create option to streamline future deployments.

The CloudFormation outputs provide the information you need to access Access Server for the first time.

Locate:

Output	Description
AdminPortal	The URL for the Access Server Admin Web UI. The initial URL uses the public IP address assigned to the instance, including the Elastic IP when selected during deployment.
TempPassword	The temporary password for the `openvpn` administrative account when you leave the Admin password parameter blank.
SSHKeyParameter	If CloudFormation generated an EC2 key pair, use the corresponding output information for SSH access.

Copy the TempPassword, if CloudFormation generated one, and store it securely.
Select the link for the AdminPortal URL.

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Deploy Access Server on AWS Using CloudFormation from Access Server Hub⁠

Overview⁠

Before you begin⁠

Was this information helpful?