Does it make senss for a company to have a VPN, if all its infrastructure is in the cloud?

Question

If all the applications, virtual machines and services we use at our company are hosted in different clouds and assuming all these services are accessed through encrypted layers (https/TLS/ssl ...).

Does getting a VPN so every employees trafic goes through our companies internet connexion (even if he's not physically in our HQ location) makes sens or is it totaly a waste of both money and bandwidth ?

I see only one usage for the VPN, and it's to have the same static IP for everyone so we can whitelist this IP only for admin access and direct access to our virtual machines and databases, instead of maintaining multiple whitelisted IPs or letting any IP trying to log on our servers and applications.

We have MFA and strong passwords, most of our files and datas are on services like Onedrive, Office 365 etc and most of our customers websites needs to be able to be accessed by any IP. So the one unique IP whitelisted rule would only be usefull for a handfull of virtual machines or databases.

Have I missed any usage ? Do I miss something, because a VPN do not look like very interesting in our case ?

I have read this question Does routing internet traffic via VPN through a company proxy gain any more security? and their answers but It is more about the utility of a proxy, which we do not plan on implementing for now.

Answer 1

Does it make sense to have a VPN for every employee, regardless of what they do?

Well, that depends on your scenario. In a modern cloud infrastructure, where everything runs on publicly accessible web applications that are protected by HTTPS the additional security benefit is rather small and may not justify the operational costs.

Things change however, if you have to rely on insecure protocols like HTTP or if you do not want to expose your servers or services to the public internet. For example, you would not want to expose your administrative interfaces (Web, RDP, SSH, ...) on the internet, as these are highly valuable targets. Here a VPN allows you to limit the group of people that have access to these services and add an additional encryption layer around an otherwise insecure communication.

Answer 2

It sounds like you would be interested in zero-trust networking, which is essentially the approach you are describing - instead of trusting a particular network, authenticate everyone individually on every service regardless of where they're coming from. Google is known for promoting this approach and adopting it internally, and I know that Cloudflare has also been doing work in this area. Given these examples, I'd say your approach is fine and can be secure, provided it is implemented correctly and every service is really protected behind strong MFA login.