Extending cloud-based virtual private networks to user equipment on radio-based networks

A computer-implemented method, comprising:

• receiving a request from a client device for service from a radio-based network;
• determining to grant access by the client device to a virtual private cloud network based at least in part on a subscriber identity module (SIM) identifier or an embedded SIM (eSIM) identifier of the client device being an identifier enumerated in a security group of the virtual private cloud network, the security group acting at an instance level to control access to a set of compute instances on the virtual private cloud network;
• providing the client device with access to the virtual private cloud network through the radio-based network in response to receiving the request from the client device for the service from the radio-based network;
• assigning a network address to the client device from a pool of network addresses associated with the virtual private cloud network;
• encapsulating network traffic from the client device via a virtual private cloud proxy in a radio access network of the radio-based network or in a core network of the radio-based network;
• and
• forwarding the encapsulated network traffic from the virtual private cloud proxy to the virtual private cloud network via a network link between the radio-based network and a cloud provider network that hosts the set of compute instances on the virtual private cloud network that are accessible to the security group.