AWS Verified Access

A modern, secure, scalable solution that enables fine-grained access control based on Zero-Trust principles, allowing access to Corporate Apps without a VPN.

By Anoop Mishra

Introduction

Secure access to corporate and internal applications is critical in today's distributed work environment. Organisations' most common and traditional approach is to have a Virtual Private Network (VPN), but they are often cumbersome to manage and provide a broad level of access, increasing security risks. Whether your applications are deployed within the AWS cloud or on external platforms such as on-premises infrastructure or third-party cloud environments, AWS Verified Access simplifies access to your internal applications using access policies integrated with your own trusted providers to assess user requests without managing the VPN infrastructure.

How it works

AWS Verified Access assesses each user request to your applications and grants access based on two criteria:

  1. Trust Data provided by your selected trust provider (either AWS or a third-party service).
  2. Access Policies that you define within Verified Access.

When a user attempts to access an application, Verified Access retrieves their trust data from the provider and evaluates it against your configured policies. Access is granted only if the user satisfies the specified security criteria. By default, all requests are denied until a policy is established.

Architecture

Key components of Verified Access^

This blog will explain how it works and the steps to configure AWS Verified Access in your AWS environment.

Type of Verifications

Verified Access supports two types of verifications:

  • Identity/User Verification integrates with AWS IAM or AWS SSO for user identity verification. You can also use third-party identity providers such as Okta, Azure AD or Google Workspace.
  • Device Posture Verification integrates with device management solutions, and AWS Verified Access verifies user device compliance. For example, it checks whether the device has up-to-date antivirus software and OS patches or is encrypted.

Access Group Policy Enforcement

AWS Verified Access evaluates access policies defined by the organisation. These policies specify which users, roles, or groups are allowed access and whether the device meets security posture requirements for the device trust provider. Policies can be enforced at the application level, ensuring only authorised users and compliant devices can access a specific app. It uses Cedar policy language, and here are some examples of the policies that can enforced.

The following is a user access policy that ensures that only the users from xyz.com domain are permitted to access the application:

permit(principal, action, resource)
when
;

Here is an example of a device compliance policy that ensures the device's location is in the US and MFA is enabled.

permit(principal, action, resource)
when
;

Based on the policy evaluation, access to the requested application is granted or denied. If access is denied, the user may be notified of the specific requirements for accessing the requested application.

Logging and Monitoring

All calls made to the application are logged in CloudWatch for auditing and monitoring purposes. Using CloudWatch alarms, you can set up alerts for unauthorised access attempts or suspicious activities to ensure the security incidents are properly handled.

Steps to Create it from AWS Console

1. Create a Verified Access Trust Provider

Configuring user trust provider

  • On the AWS Console, select VPC and go to the AWS Verified Access section.
  • Select Verified Access trust providers and click Create Verified Access trust provider button.
  • Select the User trust provider as the Trust provider type and the required information based on the User trust provider type that you want to integrate. You can either choose IAM Identity Centre or your corporate Identity provider's OIDC settings to incorporate it.

Configuring user trust provider

  • To configure this verification:
    • On the AWS Console, select VPC and go to the AWS Verified Access section.
    • Select Verified Access trust providers and click Create Verified Access trust provider button.
    • Select the Device trust provider as the Trust provider type and enter the Device trust provider type that you want to integrate.

2. Create a Verified Access Group

A Verified Access Group allows you to manage policies and configurations for multiple endpoints at once. You can assign endpoints to a group for easier management.

  • Navigate to the Verified Access Groups section.
  • Click Create Verified Access Group.
  • Specify the policies that apply to the group, such as user identity verification and device posture checks. For policy examples, refer to the Access Group Policy Enforcement section of this blog.

3. Create a Verified Access Endpoint

  • In the Verified Access section, choose Endpoints and click Create Endpoint.
  • Configure the Verified Access endpoint:
    • Name: Give your endpoint a descriptive name.
    • Application Load Balancer (ALB) or Network Load Balancer (NLB): Select the type of load balancer you use to route traffic to your application.
    • Target: Choose the load balancer the endpoint will use to route traffic to your application.

You can either select an existing Verified Access group policy to attach to your endpoint or configure the access policies while creating the endpoint in this section.

Infrastructure As Code

The steps above describe configuring the required settings using the AWS Management Console. However, if you prefer using Infrastructure as Code (IaC) to automate this process, you can visit our Mantalus GitHub repository, which contains CDK code written in Python. With this approach, you can deploy the entire configuration with simple commands.