AWS Client VPN unused endpoint association cost is the hourly charge for a target network that stays associated while nobody is connected. The endpoint can show an empty session list and still bill. AWS splits the meter in two: each endpoint association, and each VPN connection. Connections accrue only while clients are connected. The association accrues because the subnet, or other target, is attached. Zero clients remove the connection hours. They do not remove the association hours.
Rutagon finds this on endpoints built for a contractor window, a migration, or a break-glass path, then left associated to two subnets "for availability." The sessions graph is a flat line. The association graph is not. People compare Client VPN to a bastion they already shut down and assume the VPN is free when idle. It is not. Session Manager versus bastion hosts is the access pattern that avoids a standing association. This article is the bill if you keep the association anyway.
What AWS Client VPN unused endpoint association cost still charges
The Client VPN overview states the split. You are charged for each endpoint association and each VPN connection on an hourly basis. IPv6 and dual-stack endpoints do not add a separate multiplier; they are charged at the same rate as IPv4 endpoints. The pricing page's worked example is specific about one Region. In US East (Ohio), an endpoint associated with one subnet is $0.10 per hour for that endpoint association. Ten connections active for one hour are $0.50 in connection fees in that same example. The association fee in the example does not depend on those ten connections existing. It is a separate line. We quote the Ohio example as the Ohio example. Other Regions publish other rates. We do not paste $0.10 into a Region the example did not name.
Two subnet associations are two association hours. A design that associates one subnet per Availability Zone doubles the idle bill before a single laptop connects. That can be the right availability choice for a VPN people use all day. It is an expensive choice for a VPN nobody has used since the project ended. The waste pattern is the association that survives the last session.
association_hour: billed per associated target network, including at zero clients
connection_hour: billed per connected client, zero when the session list is empty
ohio_example: $0.10 per hour for one subnet association
ohio_example_connections: $0.50 for ten connections held for one hour
stop_association_fee: disassociate the target network
Public addresses can sit on the same endpoint. If the VPC has an internet gateway, Client VPN attaches elastic IP addresses to the endpoint network interfaces, and those addresses are billed as in-use public IPv4 addresses. That charge is not the association hour, and it does not go away because the session list is empty. The idle elastic IP cleanup belongs in the same pass. Connection logging is a CloudWatch Logs charge if you turned it on. A client-connect handler is a Lambda charge if you turned it on. None of those are reasons to ignore the association hour. They are extra lines on an endpoint you may not need.
How the association stays after the users leave
Creating the endpoint is not the whole meter. The target network association is. An endpoint with no associated subnet cannot deliver traffic into the VPC, and it also should not be accruing association hours. Teams create the endpoint, associate the subnets, hand out a configuration file, and never reverse the association when the contractors finish. The configuration file still works the next time someone tries, which feels like a feature. It is a standing hourly cost plus a standing network path.
Authorization rules and routes do not replace the association fee. You can have strict group rules and still pay for the subnet association every hour those rules sit unused. Split-tunnel versus full-tunnel changes what traffic enters the tunnel. It does not zero the association. Certificate authentication versus directory authentication does not zero it either. The identity design and the cost design are different edits.
Self-service portal and connection logging are useful when people actually connect. On an unused endpoint they are features you are maintaining for a path that should have been removed. We do not start by tuning the portal. We ask who connected in the last window. Connection logs answer that if logging was enabled. If logging was never enabled, the session list and the people who own the endpoint are the evidence, and the association hour is still not in doubt. The docs bill it whether or not you kept logs.
A Transit Gateway attachment is also a target network. The overview allows subnet associations or a Transit Gateway attachment. Either way, the charge language is per endpoint association. We count attachments, not just subnets, before we say an endpoint is idle-but-cheap. An attachment you forgot is the same leak as a subnet you forgot.
Modifying the endpoint can reset connections. That is an availability concern when people are using it. It is not a cost concern when nobody is. Disassociating a subnet on a live VPN kicks the path. Disassociating a subnet on a VPN with zero clients removes the meter. We do the second without ceremony once the owner confirms the endpoint is not a required break-glass. If it is break-glass, the owner accepts the association hour in writing. An unowned break-glass path is how these bills survive.
What we remove
The inventory is the endpoint, each association, the connection hours, and the in-use public addresses tied to the endpoint network interfaces. Connection hours near zero with association hours at every hour in the window is the finding. The fix is to disassociate the target networks, and to delete the endpoint if nobody will associate it again. Deleting only the client configuration file on a laptop does nothing to the association. The cloud object is what bills.
We check both the association and the address. Removing the association should release the path. If an elastic IP remains allocated, that is the next line, priced on the public IPv4 page rather than guessed here. We do not quote an IPv4 rate we did not pull for that account's Region.
AWS cloud infrastructure is where the endpoint should live if it must exist: in code, associated in the environments that need it, not cloned into every account because a module defaulted the association to on. A module that always associates two subnets will recreate the idle bill the day someone applies it.
Rutagon's cost pass separates association hours from connection hours and names the Ohio example only as the Ohio example. The pattern does not depend on that rate. An associated target with no clients is the waste. The rate is whatever the pricing page lists for the Region. We look it up. We do not average it into a national number.
Frequently Asked Questions
Does AWS Client VPN bill when no one is connected?
The association and the connection are separate hourly charges. Connection hours follow connected clients, so zero clients means zero connection hours. Association hours follow each associated target network, so an endpoint that still has a subnet associated keeps billing. An empty session list is not a zero bill.
What is the published example rate?
In the Client VPN pricing example for US East (Ohio), one subnet association is $0.10 per hour, and ten connections active for one hour are $0.50. That example is how the two meters split. It is not a promise that every Region is $0.10. Read the pricing page for the Region the endpoint actually uses.
Do two subnets cost more than one when nobody is connected?
Yes. The documentation charges each endpoint association, so two associated subnets are two association hours even when the connection count is zero. High availability across zones is a real design and also a doubled idle bill. Drop the extra association if the endpoint is no longer in use.
Are the elastic IP addresses included in the association hour?
No. If the VPC has an internet gateway, the endpoint network interfaces receive public addresses billed as in-use public IPv4 addresses, which is an additional line. Disassociate and then confirm the addresses are released. Connection logging and a connect handler add CloudWatch and Lambda charges on top, if you enabled them.
Is deleting the endpoint the only way to stop the fee?
Stopping the association fee means removing the association that the docs bill by the hour. If the endpoint should not exist, delete it after the associations are gone. If someone still needs it next month, the owner should accept the hourly association until then. Leaving it associated with no owner is the leak.
Ask for an AWS cost diagnostic that separates Client VPN association hours from connection hours. Contact Rutagon at rutagon.com/contact, 907-841-8407, or contact@rutagon.com.