AWS Client VPN Gets Device Posture Assessment: Non-Compliant Devices Get Disconnected!
Hi everyone, it's Shii-chan! Today's news levels up AWS Client VPN security!
AWS What's New
aws.amazon.com
What was announced?
According to AWS What's New, AWS Client VPN now supports device posture assessment. You can verify that connecting devices meet your security and compliance requirements before granting network access.
The story so far
Previously, Client VPN authenticated users through certificates, SAML, or Active Directory.
That verified who the user was, but not the state of their device.
What changes
It integrates with your existing device posture providers, so only trusted, compliant devices can reach your AWS resources.
The supported providers are:
- CrowdStrike
- Jamf
- JumpCloud
Device security signals such as compliance scores, encryption status, and risk level are evaluated automatically before a connection is allowed.
Dive Deep
- You define requirements with Cedar policies, giving fine-grained control over which devices can connect
- A Test Policy tool helps you author and validate those policies
- Compliance is continuously re-evaluated during active sessions, and a session is disconnected automatically if the device falls out of compliance, such as when risk score or security settings change
- Monitoring-only mode logs evaluation results without disconnecting sessions, so you can assess the impact before enforcing
- It requires AWS VPN Client version 6.2.0 or later
- It is available at no extra charge in all AWS Regions where Client VPN is available
Wrap-up
- Client VPN adds device posture assessment
- Works with CrowdStrike, Jamf, and JumpCloud, with conditions defined in Cedar policies
- Re-evaluates during sessions and disconnects automatically when devices fall out of compliance
- Monitoring-only mode lets you check the impact first
This is for security teams who want to protect device state, not just identity, on remote-work VPNs!
