VPC with OpenVPN or AWS VPN client?

As you identified using a VPN is the best solution to provide encrypted traffic between yourself and the resources in question. You have several choices:

• AWS Client to VPN - Provides the flexibility of connecting from anywhere in the world, the infrastructure will be managed by AWS. In the event of an AZ failure you can migrate to another AZ easily.
• EC2 VPN (such as OpenVPN) - Provides additional feature ranges, however you are entirely responsible for scaling and managing instance failure.

Personally I would opt for the AWS managed solution primarily because it mitigates the risk of AZ failures removing your access to the cluster. You can reduce your costs of using this option by scripting to shutdown client VPN connections out of hours.