What problem does it solve?
Replacing traditional VPNs with identity- and device-aware access to internal AWS applications is complex, requiring correct trust provider setup, Cedar policy authoring, and endpoint configuration. This Skill guides the full deployment of AWS Verified Access so internal applications are reachable only after identity and device posture checks pass.
Core Features & Use Cases
- Trust Provider Setup: Configure identity providers (AWS IAM Identity Center, Okta OIDC) and device trust providers (CrowdStrike, Jamf, JumpCloud) and attach them to a Verified Access instance.
- Cedar Policy Authoring: Write group-level and endpoint-level Cedar policies combining group membership, device posture scores, and request context.
- Infrastructure as Code: Deploy instances, groups, endpoints, logging, and multi-account sharing via AWS RAM using Terraform or AWS CLI.
- Use Case: A security engineer needs to expose an internal HR application behind an ALB without a VPN. The Skill provides the CLI commands, Terraform resources, and Cedar policies to enforce that only Okta users in the hr-team group with a CrowdStrike device score above 50 can connect, with access logs sent to CloudWatch and S3.
Quick Start
Ask the AI to generate the Terraform configuration and Cedar policy for an AWS Verified Access endpoint protecting an internal ALB with Okta identity and CrowdStrike device trust.
