AWS Verified Access Newsince 2022
A service providing zero-trust access to corporate applications without a VPN
What It Does
AWS Verified Access is a zero-trust network access service that provides secure access to internal corporate applications without a VPN. It grants or denies access based on user identity (IAM Identity Center, Okta, etc.) and device security posture (CrowdStrike, Jamf, etc.).
Use Cases
Remote worker access to internal applications, VPN elimination or reduction, per-application access control, and applying access policies based on device security posture.
Everyday Analogy
Think of an office building with smart locks. Previously, a badge (VPN) gave access to every floor. Verified Access performs identity verification and device inspection at each floor (application), granting access only to authorized floors.
What Is Verified Access?
AWS Verified Access is an application access service based on zero-trust principles. Traditional VPNs grant access to the entire network, but Verified Access controls access per application. Policies define "who" from "which device" can access "which application," granting access only when conditions are met.
Trust Providers and Policies
Verified Access uses two types of trust providers. Identity providers (IAM Identity Center, Okta, Ping Identity) verify user identity, and device management providers (CrowdStrike, Jamf) verify device security posture. Access rules are written in the Cedar policy language, enabling fine-grained access control based on user attributes (department, role) and device state (OS version, patch status).
Getting Started
Configure trust providers in the Verified Access console and create a Verified Access instance. Define access groups and endpoints, then write access rules in Cedar policies. Users access the endpoint URL in their browser, and after authentication and device verification, they connect to the application.
Things to Watch Out For
- Per-application endpoint hourly charges and data processing charges apply
- At launch it supported HTTP/HTTPS applications only, but since February 2025 it also supports non-HTTP (TCP) resources, protecting connections such as SSH, RDP, and RDS
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
If this page and the official documentation disagree, treat the official documentation as authoritative.
