AWS Verified Access New2022年〜
A service providing zero-trust access to corporate applications without a VPN
What It Does
AWS Verified Access is a zero-trust network access service that provides secure access to internal corporate applications without a VPN. It grants or denies access based on user identity (IAM Identity Center, Okta, etc.) and device security posture (CrowdStrike, Jamf, etc.).
Use Cases
Remote worker access to internal applications, VPN elimination or reduction, per-application access control, and applying access policies based on device security posture.
Everyday Analogy
Think of an office building with smart locks. Previously, a badge (VPN) gave access to every floor. Verified Access performs identity verification and device inspection at each floor (application), granting access only to authorized floors.
What Is Verified Access?
AWS Verified Access is an application access service based on zero-trust principles. Traditional VPNs grant access to the entire network, but Verified Access controls access per application. Policies define "who" from "which device" can access "which application," granting access only when conditions are met.
Trust Providers and Policies
Verified Access uses two types of trust providers. Identity providers (IAM Identity Center, Okta, Ping Identity) verify user identity, and device management providers (CrowdStrike, Jamf) verify device security posture. Access rules are written in the Cedar policy language, enabling fine-grained access control based on user attributes (department, role) and device state (OS version, patch status). For reference material on trust providers and policies, related books on Amazon are a useful resource.
Getting Started
Configure trust providers in the Verified Access console and create a Verified Access instance. Define access groups and endpoints, then write access rules in Cedar policies. Users access the endpoint URL in their browser, and after authentication and device verification, they connect to the application.
Things to Watch Out For
- Per-application endpoint hourly charges and data processing charges apply
- Currently supports HTTP/HTTPS applications only. Non-HTTP protocols like SSH and RDP are not supported
