c4.9 Enforce zero trust access
Use context as an additional authentication factor for VPN-less access to internal applications: network source, device posture (anti-malware running/updated, approved OS), and other signals decide when to allow access or require step-up verification. AWS Verified Access implements this.
Implementation guidance
Context-aware, VPN-less access
Zero trust reduces friction while improving security by evaluating context on every request rather than trusting a network location. Signals such as the source network, device posture (is anti-malware running and updated, is the OS approved), and workstation configuration decide whether to allow access or require step-up verification such as MFA.
AWS Verified Access
AWS Verified Access provides secure, VPN-less access to internal applications by: 1. Authenticating with your identity provider (for example Okta or Microsoft Entra ID). 2. Gathering device posture from trust providers such as CrowdStrike and Jamf. 3. Combining identity and device signals with the requested resource in policies that decide when to allow access.
Verified Access uses Cedar, an open-source policy language optimized for fast evaluation of zero-trust conditions.
How it fits together
How to validate
- Do you evaluate context (identity, device posture, network) on access to internal applications rather than trusting a network location?
- Do you require step-up verification (such as MFA) when signals are anomalous?
- Are you using a zero-trust access service (such as AWS Verified Access) integrated with your IdP and device trust providers?
Threats addressed
- Trusting a network location (for example "on the VPN") lets a compromised device or stolen session reach internal applications; without per-request context checks, there is no signal to trigger step-up verification.
AWS services
AWS Verified Access 
AWS IAM Identity Center