Disconnect on timeout not set for client VPN endpoint

[dsotirho-ucsc]

Our client VPN endpoints are currently use the default value (disabled) for the Disconnect on session timeout setting On April 30th, AWS will be changing the default value to enabled for newly created client VPNs (see below).

We need to see what the consequences of enabling Disconnect on session timeout would be.

Note: Terraform currently does not offer a resource attribute for this setting.

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_endpoint

From AWS:

Starting April 30, 2025, the default behavior for new AWS Client VPN [1] endpoints will change from disconnect-on-session-timeout=false to disconnect-on-session-timeout=true. This means that for new Client VPN endpoints created after April 30, 2025, if an administrator has set a maximum session duration time [2], users will need to manually reconnect to the VPN once their session expires. You can override this default behavior by specifying disconnect-on-session-timeout=false for any Client VPN endpoint.

Existing Client VPN endpoints created prior to April 30, 2025, will not be affected by this change. You can use the DescribeClientVpnEndpoints API [3] to view the current value, and the ModifyClientVpnEndpoint API [4] to change this setting for existing endpoints.

Disconnect on session timeout: This flag will disconnect your connection on session timeout which requires users to reconnect again manually. If disabled, Client VPN will attempt to reconnect the session after timeout automatically.

[hannes-ucsc]

Surely, TF support will be added soon. Assignee to monitor the TF provider documentation.

Once support is available, I'd like to test what effect enabling the setting has on the VPN client. The test should use a short session timeout. We have a mandate to implement a session timeout but there is no mandate to prevent clients from automatically reconnecting after the session times out. Enabling pro-active disconnects might actual help with VPN clients maintain persistent connectivity (my client gets stuck at times, preventing it from reconnecting).