We are working with a vendor whose incoming firewall will block any and all traffic that is not from a whitelisted IP address.

Unfortunately, our employees all work remotely, and trying to manage rotating residential IP addresses would be nightmarish.

To try and solve this, we are thinking about utilizing AWS VPN, with the idea being all employees can use the VPN desktop client to connect to a VPC, and this VPC has open access to the internet with a fixed IP via public subnet.

In the documentation we’ve read, there always seems to be some sort of middleware, such as an EC2 instance (that typically runs OpenVPN).

Is this feasible with just AWS VPN, no EC2 and no OpenVPN? It seems like we could control connection auth via lambda/cognito.