For doing ssh into our AWS infrastructure outside of office, we are required to connect to a VPN which gives us an office IP. Once we are connected to this VPN we are required to connect to another VPN (which is only accessible from office IPs), and only when we are connected to this VPN, we can ssh into the machines.
The first layer of VPN makes sense, but does second layer adds any extra security?
The reason that I'm given is that opening ssh ports to office IPs is dangerous as there are way to many computers in our network and if any one of them is compromised it would simply leave the window open.
On questioning why can't the external VPN be made publicly accessible, I'm told that it is akin to having a SSH bastion open to the world.
Connecting to two VPNs every time is slow and fragile and even the latest MacOSs don't support.
So what do you guys think? Having two layer of VPNs really adds up security? Is the trade-off worth it?