We have an example of deploying an AWS Client VPN using an AWS Directory for authenticate in our CloudFormation templates library. See https://github.com/CU-CommunityApps/cu-aws-cloudformation/tree/master/client-vpn.
Cornell teams should note that you can create an AD Connector within the AWS Directory Service, which can be connected to Cornell Active Directory. With that, you can deploy an AWS Client VPN that authenticates against Cornell AD.