We have an AWS network which can only be accessed once connected to a VPN.
Currently, in order to connect to the VPN, our IP needs to be whitelisted from within aws which can only be done by a small group of people. This can be bothersome for remote workers who then cannot access the VPN should this group of people be offline.
I proposed we add username/password / 2-factor authentication to the VPN configuration and do away with IP whitelist approach, however, there is some pushback around security concerns.
My question is are these concerns valid? Would password-based authentication be enough seeing as it's enough to access the console which controls the whitelist?