How to establish a VPN connection to an Amazon VPC

Question

I am running an Amazon EC2 instance which I use as a workstation. Right now it's in a public subnet and I connect to it through RDP by using its public IP. However, I'm concerned that this might not be a good and secure setup, even though it has a security group that limits most oncoming traffic.

It occurred to me that it might be better to place the instance in a private subnet, create a secure VPN connection from my end to the VPC, and RDP to the instance like it was in the same private network. Does this make sense? If so, how would I establish such a connection? Much of the information I find on Google is about establishing a VPN connection through hardware, but I guess there should be a way to do it through software, and I can't seem to find a proper explanation.

Thanks in advance!

Answer 1

RDP is encrypted so I'm not sure you'll get much more security by adding a VPN in the mix. What you're describing sounds similar to a bastion host that you place between you and the hosts in your VPC. It's a common setup and well documented online.

The private vs public subnet is more of an implementation detail that on its own doesn't add much security, it all depends on your setup.

If you're just going to have a single host I wouldn't go to the effort of setting up a bastion as it'll just be more to pay for and more to maintain. You can achieve the same level of security with security groups IMO.