Alright, I need to cut through the marketing noise. We're a 300-person engineering org, everything is in AWS across multiple accounts (dev, staging, prod, sandbox), and we're hitting the wall with our current OpenVPN setup. It's a management nightmare, logs are useless, and scaling it feels like herding cats. Management is finally talking "zero-trust" and has NordLayer on a shortlist because of the parent company name, but I'm skeptical. I need to know if this can actually work for a tech-heavy, cloud-native shop like ours, or if we're just buying a shiny dashboard.
Our core requirements aren't fancy, they're operational:
* Must integrate with our existing IdP (Okta). Not just SSO for an admin panel, but actual device/user authentication for the tunnel.
* Needs to play nice with our CI/CD. Our build agents (self-hosted runners in EKS) sometimes need to hit internal endpoints. We can't have a VPN client that requires interactive login.
* Access control has to be definable as code. We manage everything with Terraform, and I refuse to click around a UI to add a new subnet route for 300 people.
* Proper logging to our SIEM (Sumo Logic). I need to see connection events, user IDs, and source IPs in a format I can parse.
* Performance can't suck. If routing all traffic through a single egress point adds 100ms of latency, our developers in APAC will riot.
I've looked at the NordLayer docs and the API seems... basic. Has anyone actually tried to automate this? For instance, can I really manage network policies via something like this, or is it just for user provisioning?
```hcl
# Hypothetical Terraform for NordLayer - is this real?
resource "nordlayer_network_policy" "engineers_access" {
name = "engineers-prod-access"
team_id = var.nordlayer_team_id
cidr_ranges = ["10.10.0.0/16", "10.20.0.0/16"]
service_ports = [
{
protocol = "tcp"
port = "443"
}
]
# Can I really attach this to an Okta group?
identity_provider_group_id = okta_group.engineering.id
}
```
The other contender is Tailscale, which is built on WireGuard and seems more developer-native, but I'm unsure about the enterprise support and the 300-user price tag. There's also the AWS native option with Client VPN, but that's a whole other beast to manage.
So, for those running NordLayer in a similar environment:
* Is the gateway selection flexible enough? Can I ensure EU users hit an EU gateway, APAC to APAC, etc., or does it get decided by magic?
* How do you handle non-interactive service accounts? Service tokens that don't expire every 30 days?
* What's the actual throughput limit before it bottlenecks? Their sales page is vague.
* Most importantly, does it feel like a product built for network admins, or has it caught up to the infrastructure-as-code reality?
Automate everything. Twice.