CLI command syntax - AWS Client VPN
connectdisconnectimport-profiledelete-profilelist-profilesget-configget-connection-statuslist-connectionsput-preferencelist-preferencessend-diagnostic-logsExit codes
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

CLI command syntax

You can use CLI commands by using the following syntax:

aws-vpn-client <COMMAND> [OPTIONS]

The CLI tool supports the following commands.

Usage: aws-vpn-client <COMMAND>

Commands:
  connect                Connect a profile through the AWS VPN Client
  disconnect             Disconnect a profile from the AWS VPN Client
  delete-profile         Delete a profile from the AWS VPN Client
  import-profile         Import a VPN connection profile
  list-profiles          List all VPN profiles
  get-config             Get configuration for a profile
  put-preference         Put a preference value
  list-preferences       List all preferences
  get-connection-status  Get the current connection status for a VPN profile
  list-connections       List all active VPN connections
  send-diagnostic-logs   Send diagnostic logs to AWS for troubleshooting
  help                   Print this message or the help of the given subcommand(s)

Options:
  -h, --help     Print help
  -V, --version  Print version

connect

Description

Establish a VPN connection to a profile.

Synopsis

aws-vpn-client connect
  --profile-name <PROFILE>
  [--auth-user-pass <AUTH_USER_PASS>]

Options

--profile-name (string)

The name of the profile to connect. This option is required.

--auth-user-pass (string)

Path to a file containing the username (line 1), password (line 2), and optional MFA code (line 3). This option is not required.

Examples

Example: Connect to a VPN profile

The following connect example establishes a VPN connection to a profile.

aws-vpn-client connect --profile-name "Production-VPN"

Output:

{
  "status": "Connected"
}

disconnect

Description

Terminate an active VPN connection.

Synopsis

aws-vpn-client disconnect
  --profile-name <PROFILE_NAME>

Options

--profile-name (string)

The name of the connected profile to disconnect. This option is required.

Examples

Example: Disconnect from a VPN profile

The following disconnect example terminates a VPN connection. There is no output on success.

aws-vpn-client disconnect --profile-name "Production-VPN"

Example: Disconnect error

The following disconnect example shows the error when the profile is not connected.

aws-vpn-client disconnect --profile-name "Production-VPN"

Output:

{
  "status": "Error",
  "message": "Profile is not connected"
}

import-profile

Description

Import a VPN connection profile.

Synopsis

aws-vpn-client import-profile
  --profile-name <PROFILE_NAME>
  --config-path <CONFIG_PATH>
  [--global]

Options

--profile-name (string)

Custom name for the imported profile. This option is required.

--config-path (string)

Path to the OpenVPN configuration file (.ovpn). This option is required.

--global (boolean)

Import as a global profile available to all users. This option requires administrator privileges.

Examples

Example: Import a profile

The following import-profile example imports a VPN connection profile.

aws-vpn-client import-profile --profile-name "Production-VPN" --config-path /path/to/vpn-config.ovpn

Output:

{
  "status": "Success"
}

Example: Import a global profile

The following import-profile example imports a global profile. This requires administrator privileges.

sudo aws-vpn-client import-profile --profile-name "Company-VPN" --config-path /path/to/config.ovpn --global

Output:

{
  "status": "Success"
}

Example: Import error with invalid file path

The following import-profile example shows the error when the configuration file is not found.

aws-vpn-client import-profile --profile-name "test" --config-path /invalid/path.ovpn

Output:

{
  "status": "Error",
  "message": "Failed to read OpenVPN config file: No such file or directory (os error 2)"
}

delete-profile

Description

Delete a profile from the client.

Synopsis

aws-vpn-client delete-profile
  --profile-name <PROFILE_NAME>

Options

--profile-name (string)

The name of the profile to delete. This option is required.

Examples

Example: Delete a profile

The following delete-profile example deletes a VPN profile. There is no output on success.

aws-vpn-client delete-profile --profile-name "Production-VPN"

Example: Delete error with nonexistent profile

The following delete-profile example shows the error when the profile does not exist.

aws-vpn-client delete-profile --profile-name "nonexistent"

Output:

{
  "status": "Error",
  "message": "Profile not found"
}

list-profiles

Description

List all VPN profiles.

Synopsis

aws-vpn-client list-profiles

Examples

Example: List all VPN profiles

The following list-profiles example lists all imported VPN profiles.

aws-vpn-client list-profiles

Output:

[
  {
    "profile-name": "Production-VPN",
    "owned-by": "jdoe",
    "auth-type": "saml",
    "imported-at": "2026-07-21T13:04:42-07:00"
  },
  {
    "profile-name": "Staging-VPN",
    "owned-by": "jdoe",
    "auth-type": "ma",
    "imported-at": "2026-07-22T10:30:00-07:00"
  }
]
Note

Global profiles (imported with --global) do not have an owned-by field.

get-config

Description

Retrieve the OpenVPN configuration for a profile.

Synopsis

aws-vpn-client get-config
  --profile-name <PROFILE_NAME>

Options

--profile-name (string)

The name of the profile to retrieve configuration for. This option is required.

Examples

Example: Retrieve OpenVPN configuration

The following get-config example retrieves the OpenVPN configuration for a profile.

aws-vpn-client get-config --profile-name "Production-VPN"

Output:

client
dev tun
proto udp
remote cvpn-endpoint-0123456789abcdef0.prod.clientvpn.us-east-1.amazonaws.com 443
remote-random-hostname
resolv-retry infinite
nobind
remote-cert-tls server
cipher AES-256-GCM
verb 3
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>
auth-user-pass
reneg-sec 0

get-connection-status

Description

Get the current connection status for a VPN profile.

Synopsis

aws-vpn-client get-connection-status
  --profile-name <PROFILE_NAME>
  [--show-details]

Options

--profile-name (string)

The name of the profile to retrieve connection status for. This option is required.

--show-details (boolean)

Include connection byte statistics in the output.

Examples

Example: Get connection status

The following get-connection-status example retrieves the connection status for a profile.

aws-vpn-client get-connection-status --profile-name "Production-VPN"

Output:

{
  "connection-status": "Connected",
  "latest-connection-attempt": {
    "initiated-by": "jdoe",
    "updated-at": "2026-07-24T15:50:36-07:00"
  }
}

Example: Get connection status with details

The following get-connection-status example includes byte statistics by using the --show-details option.

aws-vpn-client get-connection-status --profile-name "Production-VPN" --show-details

Output:

{
  "connection-status": "Connected",
  "latest-connection-attempt": {
    "initiated-by": "jdoe",
    "updated-at": "2026-07-24T15:50:36-07:00",
    "details": {
      "tunnel-bytes-in": 0,
      "tunnel-bytes-out": 0,
      "transport-bytes-in": 9674,
      "transport-bytes-out": 11413
    }
  }
}

list-connections

Description

List all active VPN connections.

Synopsis

aws-vpn-client list-connections

Examples

Example: List active connections

The following list-connections example lists all active VPN connections.

aws-vpn-client list-connections

Output:

[
  {
    "profile-name": "Production-VPN",
    "initiated-by": "jdoe",
    "connection-status": "Connected",
    "last-updated-at": "2026-07-24T15:50:36-07:00"
  }
]

Example: No active connections

The following list-connections example shows the output when there are no active connections.

aws-vpn-client list-connections

Output:

[]

put-preference

Description

Set a global configuration preference. Most settings require administrator privileges.

Synopsis

aws-vpn-client put-preference
  --key <PREFERENCE_KEY>
  --value <PREFERENCE_VALUE>

Options

--key (string)

The name of the preference key to set. This option is required.

--value (string)

The value to set for the preference key. This option is required.

The following preference keys are available:

enable-telemetry

Enable or disable telemetry (true/false).

enable-user-profile-management

Allow or disallow end users to import or delete profiles (true/false).

max-connections

Maximum number of concurrent connections (integer, 1-5).

Examples

Example: Set a preference

The following put-preference example sets the maximum number of connections. This requires administrator privileges. There is no output on success.

sudo aws-vpn-client put-preference --key max-connections --value 4

Example: Error without administrator privileges

The following put-preference example shows the error when you run the command without administrator privileges.

aws-vpn-client put-preference --key max-connections --value 4

Output:

{
  "status": "Error",
  "message": "Permission denied: admin privileges required"
}

Example: Error with invalid value

The following put-preference example shows the error when you provide an invalid value.

sudo aws-vpn-client put-preference --key max-connections --value 8

Output:

{
  "status": "Error",
  "message": "Preference value is invalid"
}

list-preferences

Description

Display all global configuration preferences and current values.

Synopsis

aws-vpn-client list-preferences

Examples

Example: List all preferences

The following list-preferences example displays all global configuration preferences and their current values.

aws-vpn-client list-preferences

Output:

{
  "enable-telemetry": true,
  "enable-user-profile-management": true,
  "max-connections": 1
}

send-diagnostic-logs

Description

Collect and submit diagnostic logs to AWS for troubleshooting.

Synopsis

aws-vpn-client send-diagnostic-logs

Examples

Example: Send diagnostic logs

The following send-diagnostic-logs example collects and submits diagnostic logs to AWS.

aws-vpn-client send-diagnostic-logs

Output:

{
  "reference-id": "us-west-2:78ff6531-5dc4-c706-7149-e6cfd8adadc7/2026-07-24-16-03-55.zip"
}
Note

Share the reference-id value with AWS Support when reporting issues.

Exit codes

The AWS Client VPN CLI tool returns the following exit codes.

Exit code Meaning
0 Success
1 General error
2 Invalid command syntax