AWS rebuilds its VPN client with a full CLI and administrative controls
On August 13, 2026 AWS shipped version 6.0 of its VPN client, rebuilt on OpenVPN3 with a full CLI and centralized administrative controls. Teams automating remote access can now script connections without third-party tooling.
August 13, 2026. AWS published version 6.0.x of its VPN client, a ground-up rebuild on OpenVPN3. Three changes stand out: a command-line interface at full parity with the GUI, administrative controls to centralise access policy, and faster connections across every OS.
For teams running fleets of endpoints and remote access, this release fixes two irritants that have lingered for years: the inability to automate the connection, and the lack of governance over distributed profiles.
The desktop client was until now the weak link of AWS Client VPN: the server-side service was mature, but the client remained a GUI application you had to drive by hand. In a world where remote work and zero trust push you to script every step of access, that gap had become untenable — and it is exactly what version 6.0 removes.
A CLI at full parity with the GUI
The most anticipated addition is the aws-vpn-client CLI, which offers full feature parity with the graphical interface. In practice, that means you can now script the VPN connection inside a pipeline, a provisioning script or an IaC deployment, where third-party tooling or manual intervention used to be required.
The syntax is spare and predictable:
aws-vpn-client connect --profile-name "Production-VPN"The command returns readable JSON — {"status": "Connected"} — and the exit codes are standardised: 0 for success, 1 for a general error, 2 for invalid syntax. That is exactly what an automation script expects.
The command set covers the full profile lifecycle: connect, disconnect, import-profile, delete-profile, list-profiles, get-config, get-connection-status and list-connections. Two commands deserve special attention for operations:
import-profile --globalimports a profile available to all users of a machine, which requires administrator privileges.put-preferencesets global preferences, includingenable-user-profile-management(whether end users may import or delete profiles) andmax-connections(a cap on concurrent connections, from 1 to 5).
Two more commands round out the operational surface: list-connections shows what is currently up, and send-diagnostic-logs bundles logs and returns a reference-id to hand to AWS Support.
The point is not just convenience. It is the convergence of networking and code: a VPN connection becomes a testable, logged, reproducible step in a pipeline, no different from a terraform apply.
Administrative controls to centralise policy
The second change fixes a structural governance gap. Until now, AWS Client VPN forced you to distribute profiles to all users, and anyone could manipulate them without permissions. Version 6.0 introduces real administrative controls:
- Profiles scoped to specific users: you restrict a profile to a given perimeter instead of exposing it to the whole machine.
- Global profiles: a profile can be declared available to all users of a device, managed centrally.
- Enforced configurations: the team can lock down approved VPN configurations and stop end users from adding or modifying profiles.
This is the move from a “personal” client to a managed one. For a CISO or a fleet administrator, it answers a real compliance question: who can establish a VPN connection, with which configuration, and who can change it. The answer becomes controllable by policy rather than left to the discretion of each workstation.
That shift matters most in regulated environments. Audits increasingly ask which configuration each endpoint used to reach the network, and whether the user could alter it. With global profiles and enable-user-profile-management disabled, both questions get a verifiable answer — the kind that survives an auditor without a spreadsheet of manual checks.
The OpenVPN3 rebuild and compatibility
The technical rebuild is not cosmetic. The client is now built on OpenVPN3, which speeds up connection establishment on every supported OS. The GUI and the CLI can run at the same time: connections persist independently of whichever interface launched them, avoiding the classic drop when you close a window.
The decisive point for migration is backward compatibility: version 6.0 remains fully compatible with existing Client VPN endpoints. No endpoint-side changes are required, which reduces the upgrade to a simple client rollout.
That also means you can pilot the new client on a subset of workstations, side by side with the old one, before committing the whole fleet.
Covered platforms are Windows (x64/ARM), macOS (x64/ARM) and Linux (x64). There are no additional charges beyond standard AWS Client VPN pricing.
What this changes in practice
For a team operating AWS Client VPN at scale, version 6.0 redraws two workflows.
The first is automated onboarding. With import-profile and connect, provisioning a new workstation can fold the VPN connection into a setup script, with no manual click:
aws-vpn-client import-profile --profile-name "Prod" --config-path /opt/vpn/prod.ovpn
aws-vpn-client connect --profile-name "Prod"The same script can verify the result with get-connection-status, so a failed VPN surfaces at provisioning time rather than in the user’s first ticket.
The second is fleet hardening. By disabling enable-user-profile-management and enforcing global profiles, you remove end users’ ability to add their own configurations — closing the door to unapproved profiles and configuration drift.
Both flows combine with existing fleet-management tooling. A profile imported via import-profile --global lends itself to deployment through a system image or an MDM tool, and the connection then triggers on demand, with no user click. The CLI finally makes the VPN client compatible with the Infrastructure as Code practices the team already applies to the rest of its estate — a workstation provisioned by script can establish its VPN connection in the same pipeline.
What is still missing
Despite the rebuild, three limits remain worth knowing before you move everything to the CLI.
- Secrets travel through a plaintext file. The
--auth-user-passoption expects the path to a file holding the username (line 1), the password (line 2) and an optional MFA code (line 3). It works for automation, but secret management stays on your plate: nothing natively integrates a secrets manager or an SSO token. - No ARM64 Linux client. Version 6.0 covers Windows (x64/ARM), macOS (x64/ARM) and Linux (x64 only). Linux workstations on ARM silicon will still need a third-party client.
- Telemetry is on by default. The
enable-telemetrypreference defaults totrue. For a sensitive fleet, that is a point to handle explicitly in your deployment policy.
None of these limits undermine the upgrade; they simply bound what the CLI can do today.
Verdict
AWS Client VPN was never bad, but it lagged on two structural expectations: automation and governance. Version 6.0 closes both at once, without a compatibility break.
If you already run AWS Client VPN, upgrade the client to 6.0.x without waiting: endpoint compatibility is guaranteed, and you immediately gain the CLI and administrative controls.
If you automate remote access, adopt the CLI in your provisioning pipelines and scripts — import-profile and connect beat manual handling, with clean exit codes.
If compliance matters, enable the administrative preferences (enable-user-profile-management set to false, global profiles) to centralise access policy instead of delegating it to workstations.
In short, 6.0 does not change what AWS Client VPN does, but how a team can operate it: it turns a graphical client into a code-drivable component, at the cost of a routine client rollout.