Achieving Zero Trust Access with AWS Verified Access - Application Connectivity Without a VPN
Eliminates VPNs and achieves zero trust access that verifies user identity and device security posture every time. It introduces fine-grained control with Cedar policies.
Zero Trust and Verified Access
Zero trust is an approach that does not adopt the traditional perimeter-based security model of "trust because you are inside the network" and instead verifies every access. A VPN provides a tunnel into the corporate network, and once a connection is checked at the time it is made, the setup tends to give access to many resources inside the network. Verified Access controls access per application and verifies the user's identity and device security posture every time. There is no need to install VPN clients, manage VPN connections, or scale VPN servers, and users access applications from a browser.
Trust Providers and Policy Design
A trust provider is a component that verifies the trustworthiness of user identities and devices. As a user trust provider, you configure IAM Identity Center or another identity provider and authenticate users with OIDC tokens. As a device trust provider, you configure a device management service and check the device's OS version, patch status, and the running status of security software. Access policies are written in the Cedar language and allow or deny access based on the combination of user group and device state. For example, you can define a policy such as "Allow access only by members of the engineers group from devices whose state has been checked by the device management service."
Endpoint Configuration and Operations
A Verified Access endpoint is created by specifying an ALB or a network interface. If you place Verified Access in front of an existing ALB, access can be evaluated before it reaches the application. You configure a custom domain and a TLS certificate on the endpoint, and users access it through a URL such as https://app.example.com. The access logs record the user ID, device information, source IP, and policy evaluation results, and can be sent to CloudWatch Logs or S3. The security team analyzes the logs to detect suspicious access patterns and puts the findings to use in improving policies.
Verified Access Pricing
Verified Access pricing consists of hourly charges for applications (endpoints) and the amount of data processed. Each endpoint costs about $0.27/hour (about $194/month), and data processing is about $0.02 per GB (as of August 2026). Because the pricing structure differs from Client VPN (about $0.05/hour per connection + about $0.10/hour per subnet association), you calculate the cost based on the number of applications to protect and the number of connections. In environments with many applications, the fixed cost of endpoints adds up, so you deploy Verified Access in phases and confirm its cost-effectiveness.
The Zero Trust Approach and How It Differs from a VPN
Traditional VPNs were based on perimeter defense, and once a connection was checked at the time it was made, the setup tended to give access to many resources inside the network. This has the weakness that once an attacker gets inside, the damage tends to spread. Zero trust assumes "trust nothing," verifies the state of the user and device on every access, and allows access only to specific permitted applications. Verified Access follows this approach and permits connections to individual applications without using a VPN. By not placing implicit trust in the entire network, it becomes hard for attackers to move between applications.
Trust Evaluation and Device State
In Verified Access, whether to allow access is decided by combining multiple perspectives. In addition to identity information about who the user is, it can also evaluate the state of whether the connecting device meets security requirements. For example, controls such as allowing connections only from managed devices kept up to date are possible. These conditions are written as policies and evaluated for each access. When you check both identity and device, if credentials are leaked, you can deny access from devices that do not meet the conditions. Multiple perspectives are combined to decide whether to allow or deny each access.
Logging and Auditing
In zero trust operations, you keep a record of who accessed what and when, and whether the access was allowed or denied. Verified Access keeps detailed logs for each access decision so that they can be audited later. Because logs can be output in a standardized format, analysis in combination with other security tools also becomes easy. If you monitor these logs, you can detect abnormal access patterns and unexpected policy behavior early. Access records are used for incident response and for confirming that policies are working as intended.
Deployment and Phased Migration
When moving from an existing VPN, you do not switch over at once but proceed in phases, application by application. First, you place some applications behind Verified Access and verify the policies and behavior. If there are no problems, you expand the scope step by step. Users can access applications from a browser or similar without starting a VPN client. During the migration, you check the access logs and steadily move to zero trust while determining whether legitimate use is being blocked.
Summary
Verified Access is a service that provides application access based on zero trust principles without using a VPN. It verifies user identity and device security posture every time and controls access for each application with Cedar policies. It can be used in situations where you connect to internal applications from a remote work environment.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS Verified Access official page
- AWS IAM official page
- Amazon CloudWatch official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.