Yesterday AWS announced
Still wanting to give it a try, I deployed a plain Windows 11 VM for testing. The Windows installer worked fine, but strangely, doesn't add any icons to launch the app, so I had to browse through the filesystem to launch the client. There's also no configuration options whatsoever in the app itself, instead it's configured by manually deploying a JSON file onto the filesystem, which looks something like this:
{
"Version": "1.0",
"VerifiedAccessInstanceId": "vai-2a7bd80dcdc3175c3",
"Region": "eu-west-1",
"DeviceTrustProviders": [],
"UserTrustProvider": {
"Type": "iam-identity-center",
"Scopes": "verified_access:application:connect",
"Issuer": "https://identitycenter.amazonaws.com/ssoins-6834324c3a3214a1",
"PkceEnabled": true
},
"OpenVpnConfigurations": [
{
"Config": "Y2xpZW5***REDACTED***hbWU=",
"Routes": [
{
"Cidr": "2a07:d018:118c:3b00::/57"
}
]
}
]
}
Cue the soul crushing realisation that the service is just a wrapper around OpenVPN. The clue is in the OpenVpnConfigurations block which is just a base64 encoded OpenVPN configuration. 😭 WireGuard is a much better VPN technology in every way, and it could have been used here. It's faster, lighter, secure by default and much simpler to implement. A .
So I copied over the configuration to the location specified on Windows, C:\ProgramData\Connectivity Client\ClientConfig1.json, and started the client. And got this..
..and that's as far as I've managed to get after following the launch blog instructions.
Given this experience, it doesn't feel like the service even warrants the 'preview' label, it's a long way from a state I would consider deploying, even for testing. Given the timing, on the first day of reInvent, I suspect commercial pressures were at play here. It's a shame, as direct access to private resources without the overhead of managing a VPN would be incredibly useful. I'll be keeping my eyes open on how it progresses and hopefully in the mid-term it will become a viable option.
SOCIAL SHARE CARD GENERATOR