[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CC0WSVS8C7TZ0JJ3F2G23":3,"skill-same:01M71CC0WSVS8C7TZ0JJ3F2G23":85},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":14,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":6,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M71CC0WSVS8C7TZ0JJ3F2G23","aws-access-aws-audit",null,"Configure AWS Verified Access to provide VPN-less zero trust network access to internal applications using identity and device posture verification with Cedar policy language.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Faws\u002Faccess\u002Faws\u002Faudit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"audit","aws access aws audit","aws","access","vpn","network","aws-ram","read","device-posture","identity-verification","vpn-less","cedar-policy","ztna","verified-access","zero-trust","verification","architecture","Bash","configure","cybersecurity","2026-11-10 10:12:30",false,"---\nname: aws-access-aws-audit\ndescription: Configure AWS Verified Access to provide VPN-less zero trust network access to internal applications using identity and device posture verification with Cedar policy language.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- zero-trust\n- aws\n- verified-access\n- ztna\n- cedar-policy\n- vpn-less\n- identity-verification\n- device-posture\n- aws-ram\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncapec: []\n---\n\n# Configuring AWS Verified Access for ZTNA\n\n## Overview\n\nAWS Verified Access is a Zero Trust Network Access (ZTNA) service that provides secure, VPN-less access to corporate applications hosted in AWS. It evaluates each access request in real-time against granular conditional access policies written in the Cedar policy language, ensuring access is granted per-application only when specific security requirements such as user identity and device security posture are met and maintained. Verified Access integrates with AWS IAM Identity Center, third-party identity providers (Okta, CrowdStrike, JumpCloud, Jamf), and device management solutions. For multi-account deployments, AWS Resource Access Manager (RAM) enables sharing Verified Access groups across organizational units.\n\n\n## When to Use\n\n- When deploying or configuring configuring aws verified access for ztna capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- AWS account with appropriate IAM permissions\n- Identity provider (AWS IAM Identity Center, Okta, or OIDC-compatible)\n- Device trust provider (CrowdStrike, Jamf, JumpCloud, or AWS Verified Access native)\n- Internal Application Load Balancer (ALB) or network interface endpoint\n- Understanding of Cedar policy language\n- VPC with application workloads to protect\n\n## Architecture\n\n```\n    End User (Browser)\n         |\n         | HTTPS\n         v\n  +------+--------+\n  | Verified      |\n  | Access        |\n  | Endpoint      |\n  | (Public DNS)  |\n  +------+--------+\n         |\n  +------+--------+\n  | Verified      |  \u003C-- Cedar Access Policies\n  | Access        |  \u003C-- Identity Provider Signals\n  | Instance      |  \u003C-- Device Trust Signals\n  | (Policy       |\n  |  Evaluation)  |\n  +------+--------+\n         |\n  +------+--------+\n  | Verified      |\n  | Access Group  |\n  | (App Group)   |\n  +------+--------+\n         |\n  +------+--------+\n  | Internal ALB  |\n  | or ENI Target |\n  +------+--------+\n         |\n  +------+--------+\n  | Application   |\n  | (Private VPC) |\n  +--------------+\n```\n\n## Core Components\n\n### Verified Access Instance\n\nThe regional entity that evaluates access requests against policies.\n\n```bash\n# Create Verified Access Instance via AWS CLI\naws ec2 create-verified-access-instance \\\n  --description \"Production Zero Trust Instance\" \\\n  --tag-specifications 'ResourceType=verified-access-instance,Tags=[{Key=Environment,Value=production}]'\n```\n\n### Trust Providers\n\n#### Identity Trust Provider (AWS IAM Identity Center)\n\n```bash\n# Create identity trust provider\naws ec2 create-verified-access-trust-provider \\\n  --trust-provider-type user \\\n  --user-trust-provider-type iam-identity-center \\\n  --policy-reference-name \"idc\" \\\n  --description \"IAM Identity Center trust provider\" \\\n  --tag-specifications 'ResourceType=verified-access-trust-provider,Tags=[{Key=Type,Value=identity}]'\n```\n\n#### Identity Trust Provider (OIDC - Okta)\n\n```bash\naws ec2 create-verified-access-trust-provider \\\n  --trust-provider-type user \\\n  --user-trust-provider-type oidc \\\n  --oidc-options '{\n    \"Issuer\": \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\",\n    \"AuthorizationEndpoint\": \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\u002Fv1\u002Fauthorize\",\n    \"TokenEndpoint\": \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\u002Fv1\u002Ftoken\",\n    \"UserInfoEndpoint\": \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\u002Fv1\u002Fuserinfo\",\n    \"ClientId\": \"0oa1234567890\",\n    \"ClientSecret\": \"client-secret-here\",\n    \"Scope\": \"openid profile groups\"\n  }' \\\n  --policy-reference-name \"okta\" \\\n  --description \"Okta OIDC trust provider\"\n```\n\n#### Device Trust Provider (CrowdStrike)\n\n```bash\naws ec2 create-verified-access-trust-provider \\\n  --trust-provider-type device \\\n  --device-trust-provider-type crowdstrike \\\n  --device-options '{\n    \"TenantId\": \"crowdstrike-tenant-id\",\n    \"PublicSigningKeyUrl\": \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust\u002Fv2\u002Fcertificates\"\n  }' \\\n  --policy-reference-name \"crowdstrike\" \\\n  --description \"CrowdStrike device trust provider\"\n```\n\n### Attach Trust Providers to Instance\n\n```bash\n# Attach identity provider\naws ec2 attach-verified-access-trust-provider \\\n  --verified-access-instance-id vai-0123456789abcdef \\\n  --verified-access-trust-provider-id vatp-0123456789abcdef\n\n# Attach device provider\naws ec2 attach-verified-access-trust-provider \\\n  --verified-access-instance-id vai-0123456789abcdef \\\n  --verified-access-trust-provider-id vatp-device123456\n```\n\n### Verified Access Groups\n\n```bash\n# Create a group for web applications\naws ec2 create-verified-access-group \\\n  --verified-access-instance-id vai-0123456789abcdef \\\n  --description \"Production Web Applications\" \\\n  --policy-document 'permit(principal, action, resource)\n    when {\n      context.okta.groups.contains(\"production-access\") &&\n      context.crowdstrike.assessment.overall > 50\n    };' \\\n  --tag-specifications 'ResourceType=verified-access-group,Tags=[{Key=Tier,Value=web}]'\n```\n\n### Verified Access Endpoints\n\n```bash\n# Create endpoint for ALB-backed application\naws ec2 create-verified-access-endpoint \\\n  --verified-access-group-id vag-0123456789abcdef \\\n  --endpoint-type load-balancer \\\n  --attachment-type vpc \\\n  --domain-certificate-arn arn:aws:acm:us-east-1:123456789012:certificate\u002Fxxxx \\\n  --application-domain app.internal.company.com \\\n  --endpoint-domain-prefix myapp \\\n  --load-balancer-options '{\n    \"LoadBalancerArn\": \"arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer\u002Fapp\u002Finternal-alb\u002Fxxxx\",\n    \"Port\": 443,\n    \"Protocol\": \"https\",\n    \"SubnetIds\": [\"subnet-abc123\", \"subnet-def456\"]\n  }' \\\n  --security-group-ids sg-0123456789abcdef \\\n  --description \"Internal HR Application\"\n```\n\n## Cedar Policy Language\n\n### Policy Basics\n\n```cedar\n\u002F\u002F Allow access for users in the engineering group with compliant devices\npermit(principal, action, resource)\nwhen {\n    context.okta.groups.contains(\"engineering\") &&\n    context.crowdstrike.assessment.overall > 70 &&\n    context.crowdstrike.assessment.sensor_config.status == \"active\"\n};\n\n\u002F\u002F Deny access from unmanaged devices\nforbid(principal, action, resource)\nwhen {\n    !context.crowdstrike.assessment.sensor_config.status == \"active\"\n};\n```\n\n### Advanced Policy Examples\n\n```cedar\n\u002F\u002F Time-based access - only during business hours (UTC)\npermit(principal, action, resource)\nwhen {\n    context.okta.groups.contains(\"contractors\") &&\n    context.http_request.http_method == \"GET\" &&\n    context.crowdstrike.assessment.overall > 80\n};\n\n\u002F\u002F Restrict admin access to specific user group with high device trust\npermit(principal, action, resource)\nwhen {\n    context.idc.groups.contains(\"admins\") &&\n    context.crowdstrike.assessment.overall > 90 &&\n    context.crowdstrike.assessment.os_version.startswith(\"Windows 11\") ||\n    context.crowdstrike.assessment.os_version.startswith(\"macOS 14\")\n};\n\n\u002F\u002F Allow read-only access for lower trust levels\npermit(principal, action, resource)\nwhen {\n    context.okta.groups.contains(\"read-only\") &&\n    context.crowdstrike.assessment.overall > 30 &&\n    context.http_request.http_method == \"GET\"\n};\n```\n\n### Group-Level vs Endpoint-Level Policies\n\n```cedar\n\u002F\u002F Group-level policy (applies to all endpoints in the group)\n\u002F\u002F Set on the Verified Access Group\npermit(principal, action, resource)\nwhen {\n    context.okta.groups.contains(\"employees\") &&\n    context.crowdstrike.assessment.overall > 50\n};\n\n\u002F\u002F Endpoint-level policy (additional restrictions for specific app)\n\u002F\u002F Set on the Verified Access Endpoint\npermit(principal, action, resource)\nwhen {\n    context.okta.groups.contains(\"hr-team\") &&\n    context.okta.email.endsWith(\"@company.com\")\n};\n```\n\n## Terraform Configuration\n\n```hcl\nterraform {\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"\n    }\n  }\n}\n\n# Verified Access Instance\nresource \"aws_verifiedaccess_instance\" \"main\" {\n  description = \"Production Zero Trust Access\"\n  tags = {\n    Environment = \"production\"\n  }\n}\n\n# Identity Trust Provider (OIDC)\nresource \"aws_verifiedaccess_trust_provider\" \"okta\" {\n  policy_reference_name    = \"okta\"\n  trust_provider_type      = \"user\"\n  user_trust_provider_type = \"oidc\"\n  description              = \"Okta identity provider\"\n\n  oidc_options {\n    authorization_endpoint = \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\u002Fv1\u002Fauthorize\"\n    client_id              = var.okta_client_id\n    client_secret          = var.okta_client_secret\n    issuer                 = \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\"\n    scope                  = \"openid profile groups\"\n    token_endpoint         = \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\u002Fv1\u002Ftoken\"\n    user_info_endpoint     = \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\u002Fv1\u002Fuserinfo\"\n  }\n}\n\n# Device Trust Provider (CrowdStrike)\nresource \"aws_verifiedaccess_trust_provider\" \"crowdstrike\" {\n  policy_reference_name     = \"crowdstrike\"\n  trust_provider_type       = \"device\"\n  device_trust_provider_type = \"crowdstrike\"\n  description               = \"CrowdStrike device trust\"\n\n  device_options {\n    tenant_id = var.crowdstrike_tenant_id\n  }\n}\n\n# Attach providers to instance\nresource \"aws_verifiedaccess_instance_trust_provider_attachment\" \"okta\" {\n  verifiedaccess_instance_id       = aws_verifiedaccess_instance.main.id\n  verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.okta.id\n}\n\nresource \"aws_verifiedaccess_instance_trust_provider_attachment\" \"crowdstrike\" {\n  verifiedaccess_instance_id       = aws_verifiedaccess_instance.main.id\n  verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.crowdstrike.id\n}\n\n# Verified Access Group\nresource \"aws_verifiedaccess_group\" \"web_apps\" {\n  verifiedaccess_instance_id = aws_verifiedaccess_instance.main.id\n  description                = \"Production Web Applications\"\n\n  policy_document = \u003C\u003C-CEDAR\n    permit(principal, action, resource)\n    when {\n      context.okta.groups.contains(\"production-access\") &&\n      context.crowdstrike.assessment.overall > 50\n    };\n  CEDAR\n\n  tags = {\n    Tier = \"web\"\n  }\n}\n\n# Verified Access Endpoint\nresource \"aws_verifiedaccess_endpoint\" \"internal_app\" {\n  verified_access_group_id = aws_verifiedaccess_group.web_apps.id\n  endpoint_type            = \"load-balancer\"\n  attachment_type          = \"vpc\"\n  domain_certificate_arn   = aws_acm_certificate.app.arn\n  application_domain       = \"app.internal.company.com\"\n  endpoint_domain_prefix   = \"myapp\"\n  description              = \"Internal Application\"\n\n  load_balancer_options {\n    load_balancer_arn = aws_lb.internal.arn\n    port              = 443\n    protocol          = \"https\"\n    subnet_ids        = var.private_subnet_ids\n  }\n\n  security_group_ids = [aws_security_group.verified_access.id]\n\n  policy_document = \u003C\u003C-CEDAR\n    permit(principal, action, resource)\n    when {\n      context.okta.groups.contains(\"app-users\")\n    };\n  CEDAR\n}\n\n# Logging configuration\nresource \"aws_verifiedaccess_instance_logging_configuration\" \"main\" {\n  verifiedaccess_instance_id = aws_verifiedaccess_instance.main.id\n\n  access_logs {\n    cloudwatch_logs {\n      enabled   = true\n      log_group = aws_cloudwatch_log_group.verified_access.name\n    }\n    s3 {\n      enabled     = true\n      bucket_name = aws_s3_bucket.access_logs.id\n      prefix      = \"verified-access\u002F\"\n    }\n  }\n}\n\nresource \"aws_cloudwatch_log_group\" \"verified_access\" {\n  name              = \"\u002Faws\u002Fverified-access\u002Fproduction\"\n  retention_in_days = 90\n}\n```\n\n## Multi-Account Deployment with AWS RAM\n\n```hcl\n# Share Verified Access Group across accounts via RAM\nresource \"aws_ram_resource_share\" \"verified_access\" {\n  name                      = \"verified-access-share\"\n  allow_external_principals = false\n}\n\nresource \"aws_ram_resource_association\" \"group_share\" {\n  resource_arn       = aws_verifiedaccess_group.web_apps.verified_access_group_arn\n  resource_share_arn = aws_ram_resource_share.verified_access.arn\n}\n\nresource \"aws_ram_principal_association\" \"workload_ou\" {\n  principal          = \"arn:aws:organizations::123456789012:ou\u002Fo-xxxx\u002Fou-xxxx-xxxxxxxx\"\n  resource_share_arn = aws_ram_resource_share.verified_access.arn\n}\n```\n\n## Monitoring and Logging\n\n```bash\n# Query access logs in CloudWatch\naws logs filter-log-events \\\n  --log-group-name \u002Faws\u002Fverified-access\u002Fproduction \\\n  --filter-pattern '{ $.status_code = \"403\" }' \\\n  --start-time $(date -d '1 hour ago' +%s000)\n\n# CloudWatch alarm for access denials\naws cloudwatch put-metric-alarm \\\n  --alarm-name \"VerifiedAccess-HighDenialRate\" \\\n  --metric-name \"AccessDenied\" \\\n  --namespace \"AWS\u002FVerifiedAccess\" \\\n  --statistic Sum \\\n  --period 300 \\\n  --threshold 100 \\\n  --comparison-operator GreaterThanThreshold \\\n  --evaluation-periods 2 \\\n  --alarm-actions arn:aws:sns:us-east-1:123456789012:security-alerts\n```\n\n## Security Best Practices\n\n1. **Layer policies**: Use group-level policies for broad controls and endpoint-level for app-specific restrictions\n2. **Require device trust**: Always include device posture checks in Cedar policies\n3. **Enable access logging**: Send to both CloudWatch and S3 for real-time monitoring and long-term retention\n4. **Use RAM for multi-account**: Share groups across OUs instead of duplicating configuration\n5. **Rotate OIDC secrets**: Automate client secret rotation via Secrets Manager\n6. **Test policies in non-production**: Validate Cedar policies before production deployment\n7. **Set high device trust thresholds**: Require overall score above 70 for production access\n8. **Monitor for policy drift**: Use AWS Config rules to detect unauthorized changes\n\n## References\n\n- [AWS Verified Access Documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Fverified-access\u002F)\n- [Cedar Policy Language](https:\u002F\u002Fwww.cedarpolicy.com\u002F)\n- [Building Zero Trust Across Multi-Account AWS Environments](https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fnetworking-and-content-delivery\u002Fbuilding-zero-trust-access-across-multi-account-aws-environments\u002F)\n- [Visual Guide to AWS Verified Access Setup](https:\u002F\u002Fmedium.com\u002F@chaim_sanders\u002Fa-visual-guide-to-setting-up-aws-verified-access-1333466f7222)\n- [NIST SP 800-207 Zero Trust Architecture](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-207\u002Ffinal)\n","# Configuring AWS Verified Access for ZTNA\n\n## Overview\n\nAWS Verified Access is a Zero Trust Network Access (ZTNA) service that provides secure, VPN-less access to corporate applications hosted in AWS. It evaluates each access request in real-time against granular conditional access policies written in the Cedar policy language, ensuring access is granted per-application only when specific security requirements such as user identity and device security posture are met and maintained. Verified Access integrates with AWS IAM Identity Center, third-party identity providers (Okta, CrowdStrike, JumpCloud, Jamf), and device management solutions. For multi-account deployments, AWS Resource Access Manager (RAM) enables sharing Verified Access groups across organizational units.\n\n\n## When to Use\n\n- When deploying or configuring configuring aws verified access for ztna capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- AWS account with appropriate IAM permissions\n- Identity provider (AWS IAM Identity Center, Okta, or OIDC-compatible)\n- Device trust provider (CrowdStrike, Jamf, JumpCloud, or AWS Verified Access native)\n- Internal Application Load Balancer (ALB) or network interface endpoint\n- Understanding of Cedar policy language\n- VPC with application workloads to protect\n\n## Architecture\n\n```\n    End User (Browser)\n         |\n         | HTTPS\n         v\n  +------+--------+\n  | Verified      |\n  | Access        |\n  | Endpoint      |\n  | (Public DNS)  |\n  +------+--------+\n         |\n  +------+--------+\n  | Verified      |  \u003C-- Cedar Access Policies\n  | Access        |  \u003C-- Identity Provider Signals\n  | Instance      |  \u003C-- Device Trust Signals\n  | (Policy       |\n  |  Evaluation)  |\n  +------+--------+\n         |\n  +------+--------+\n  | Verified      |\n  | Access Group  |\n  | (App Group)   |\n  +------+--------+\n         |\n  +------+--------+\n  | Internal ALB  |\n  | or ENI Target |\n  +------+--------+\n         |\n  +------+--------+\n  | Application   |\n  | (Private VPC) |\n  +--------------+\n```\n\n## Core Components\n\n### Verified Access Instance\n\nThe regional entity that evaluates access requests against policies.\n\n```bash\n# Create Verified Access Instance via AWS CLI\naws ec2 create-verified-access-instance \\\n  --description \"Production Zero Trust Instance\" \\\n  --tag-specifications 'ResourceType=verified-access-instance,Tags=[{Key=Environment,Value=production}]'\n```\n\n### Trust Providers\n\n#### Identity Trust Provider (AWS IAM Identity Center)\n\n```bash\n# Create identity trust provider\naws ec2 create-verified-access-trust-provider \\\n  --trust-provider-type user \\\n  --user-trust-provider-type iam-identity-center \\\n  --policy-reference-name \"idc\" \\\n  --description \"IAM Identity Center trust provider\" \\\n  --tag-specifications 'ResourceType=verified-access-trust-provider,Tags=[{Key=Type,Value=identity}]'\n```\n\n#### Identity Trust Provider (OIDC - Okta)\n\n```bash\naws ec2 create-verified-access-trust-provider \\\n  --trust-provider-type user \\\n  --user-trust-provider-type oidc \\\n  --oidc-options '{\n    \"Issuer\": \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\",\n    \"AuthorizationEndpoint\": \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\u002Fv1\u002Fauthorize\",\n    \"TokenEndpoint\": \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\u002Fv1\u002Ftoken\",\n    \"UserInfoEndpoint\": \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\u002Fv1\u002Fuserinfo\",\n    \"ClientId\": \"0oa1234567890\",\n    \"ClientSecret\": \"client-secret-here\",\n    \"Scope\": \"openid profile groups\"\n  }' \\\n  --policy-reference-name \"okta\" \\\n  --description \"Okta OIDC trust provider\"\n```\n\n#### Device Trust Provider (CrowdStrike)\n\n```bash\naws ec2 create-verified-access-trust-provider \\\n  --trust-provider-type device \\\n  --device-trust-provider-type crowdstrike \\\n  --device-options '{\n    \"TenantId\": \"crowdstrike-tenant-id\",\n    \"PublicSigningKeyUrl\": \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust\u002Fv2\u002Fcertificates\"\n  }' \\\n  --policy-reference-name \"crowdstrike\" \\\n  --description \"CrowdStrike device trust provider\"\n```\n\n### Attach Trust Providers to Instance\n\n```bash\n# Attach identity provider\naws ec2 attach-verified-access-trust-provider \\\n  --verified-access-instance-id vai-0123456789abcdef \\\n  --verified-access-trust-provider-id vatp-0123456789abcdef\n\n# Attach device provider\naws ec2 attach-verified-access-trust-provider \\\n  --verified-access-instance-id vai-0123456789abcdef \\\n  --verified-access-trust-provider-id vatp-device123456\n```\n\n### Verified Access Groups\n\n```bash\n# Create a group for web applications\naws ec2 create-verified-access-group \\\n  --verified-access-instance-id vai-0123456789abcdef \\\n  --description \"Production Web Applications\" \\\n  --policy-document 'permit(principal, action, resource)\n    when {\n      context.okta.groups.contains(\"production-access\") &&\n      context.crowdstrike.assessment.overall > 50\n    };' \\\n  --tag-specifications 'ResourceType=verified-access-group,Tags=[{Key=Tier,Value=web}]'\n```\n\n### Verified Access Endpoints\n\n```bash\n# Create endpoint for ALB-backed application\naws ec2 create-verified-access-endpoint \\\n  --verified-access-group-id vag-0123456789abcdef \\\n  --endpoint-type load-balancer \\\n  --attachment-type vpc \\\n  --domain-certificate-arn arn:aws:acm:us-east-1:123456789012:certificate\u002Fxxxx \\\n  --application-domain app.internal.company.com \\\n  --endpoint-domain-prefix myapp \\\n  --load-balancer-options '{\n    \"LoadBalancerArn\": \"arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer\u002Fapp\u002Finternal-alb\u002Fxxxx\",\n    \"Port\": 443,\n    \"Protocol\": \"https\",\n    \"SubnetIds\": [\"subnet-abc123\", \"subnet-def456\"]\n  }' \\\n  --security-group-ids sg-0123456789abcdef \\\n  --description \"Internal HR Application\"\n```\n\n## Cedar Policy Language\n\n### Policy Basics\n\n```cedar\n\u002F\u002F Allow access for users in the engineering group with compliant devices\npermit(principal, action, resource)\nwhen {\n    context.okta.groups.contains(\"engineering\") &&\n    context.crowdstrike.assessment.overall > 70 &&\n    context.crowdstrike.assessment.sensor_config.status == \"active\"\n};\n\n\u002F\u002F Deny access from unmanaged devices\nforbid(principal, action, resource)\nwhen {\n    !context.crowdstrike.assessment.sensor_config.status == \"active\"\n};\n```\n\n### Advanced Policy Examples\n\n```cedar\n\u002F\u002F Time-based access - only during business hours (UTC)\npermit(principal, action, resource)\nwhen {\n    context.okta.groups.contains(\"contractors\") &&\n    context.http_request.http_method == \"GET\" &&\n    context.crowdstrike.assessment.overall > 80\n};\n\n\u002F\u002F Restrict admin access to specific user group with high device trust\npermit(principal, action, resource)\nwhen {\n    context.idc.groups.contains(\"admins\") &&\n    context.crowdstrike.assessment.overall > 90 &&\n    context.crowdstrike.assessment.os_version.startswith(\"Windows 11\") ||\n    context.crowdstrike.assessment.os_version.startswith(\"macOS 14\")\n};\n\n\u002F\u002F Allow read-only access for lower trust levels\npermit(principal, action, resource)\nwhen {\n    context.okta.groups.contains(\"read-only\") &&\n    context.crowdstrike.assessment.overall > 30 &&\n    context.http_request.http_method == \"GET\"\n};\n```\n\n### Group-Level vs Endpoint-Level Policies\n\n```cedar\n\u002F\u002F Group-level policy (applies to all endpoints in the group)\n\u002F\u002F Set on the Verified Access Group\npermit(principal, action, resource)\nwhen {\n    context.okta.groups.contains(\"employees\") &&\n    context.crowdstrike.assessment.overall > 50\n};\n\n\u002F\u002F Endpoint-level policy (additional restrictions for specific app)\n\u002F\u002F Set on the Verified Access Endpoint\npermit(principal, action, resource)\nwhen {\n    context.okta.groups.contains(\"hr-team\") &&\n    context.okta.email.endsWith(\"@company.com\")\n};\n```\n\n## Terraform Configuration\n\n```hcl\nterraform {\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"\n    }\n  }\n}\n\n# Verified Access Instance\nresource \"aws_verifiedaccess_instance\" \"main\" {\n  description = \"Production Zero Trust Access\"\n  tags = {\n    Environment = \"production\"\n  }\n}\n\n# Identity Trust Provider (OIDC)\nresource \"aws_verifiedaccess_trust_provider\" \"okta\" {\n  policy_reference_name    = \"okta\"\n  trust_provider_type      = \"user\"\n  user_trust_provider_type = \"oidc\"\n  description              = \"Okta identity provider\"\n\n  oidc_options {\n    authorization_endpoint = \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\u002Fv1\u002Fauthorize\"\n    client_id              = var.okta_client_id\n    client_secret          = var.okta_client_secret\n    issuer                 = \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\"\n    scope                  = \"openid profile groups\"\n    token_endpoint         = \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\u002Fv1\u002Ftoken\"\n    user_info_endpoint     = \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\u002Fv1\u002Fuserinfo\"\n  }\n}\n\n# Device Trust Provider (CrowdStrike)\nresource \"aws_verifiedaccess_trust_provider\" \"crowdstrike\" {\n  policy_reference_name     = \"crowdstrike\"\n  trust_provider_type       = \"device\"\n  device_trust_provider_type = \"crowdstrike\"\n  description               = \"CrowdStrike device trust\"\n\n  device_options {\n    tenant_id = var.crowdstrike_tenant_id\n  }\n}\n\n# Attach providers to instance\nresource \"aws_verifiedaccess_instance_trust_provider_attachment\" \"okta\" {\n  verifiedaccess_instance_id       = aws_verifiedaccess_instance.main.id\n  verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.okta.id\n}\n\nresource \"aws_verifiedaccess_instance_trust_provider_attachment\" \"crowdstrike\" {\n  verifiedaccess_instance_id       = aws_verifiedaccess_instance.main.id\n  verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.crowdstrike.id\n}\n\n# Verified Access Group\nresource \"aws_verifiedaccess_group\" \"web_apps\" {\n  verifiedaccess_instance_id = aws_verifiedaccess_instance.main.id\n  description                = \"Production Web Applications\"\n\n  policy_document = \u003C\u003C-CEDAR\n    permit(principal, action, resource)\n    when {\n      context.okta.groups.contains(\"production-access\") &&\n      context.crowdstrike.assessment.overall > 50\n    };\n  CEDAR\n\n  tags = {\n    Tier = \"web\"\n  }\n}\n\n# Verified Access Endpoint\nresource \"aws_verifiedaccess_endpoint\" \"internal_app\" {\n  verified_access_group_id = aws_verifiedaccess_group.web_apps.id\n  endpoint_type            = \"load-balancer\"\n  attachment_type          = \"vpc\"\n  domain_certificate_arn   = aws_acm_certificate.app.arn\n  application_domain       = \"app.internal.company.com\"\n  endpoint_domain_prefix   = \"myapp\"\n  description              = \"Internal Application\"\n\n  load_balancer_options {\n    load_balancer_arn = aws_lb.internal.arn\n    port              = 443\n    protocol          = \"https\"\n    subnet_ids        = var.private_subnet_ids\n  }\n\n  security_group_ids = [aws_security_group.verified_access.id]\n\n  policy_document = \u003C\u003C-CEDAR\n    permit(principal, action, resource)\n    when {\n      context.okta.groups.contains(\"app-users\")\n    };\n  CEDAR\n}\n\n# Logging configuration\nresource \"aws_verifiedaccess_instance_logging_configuration\" \"main\" {\n  verifiedaccess_instance_id = aws_verifiedaccess_instance.main.id\n\n  access_logs {\n    cloudwatch_logs {\n      enabled   = true\n      log_group = aws_cloudwatch_log_group.verified_access.name\n    }\n    s3 {\n      enabled     = true\n      bucket_name = aws_s3_bucket.access_logs.id\n      prefix      = \"verified-access\u002F\"\n    }\n  }\n}\n\nresource \"aws_cloudwatch_log_group\" \"verified_access\" {\n  name              = \"\u002Faws\u002Fverified-access\u002Fproduction\"\n  retention_in_days = 90\n}\n```\n\n## Multi-Account Deployment with AWS RAM\n\n```hcl\n# Share Verified Access Group across accounts via RAM\nresource \"aws_ram_resource_share\" \"verified_access\" {\n  name                      = \"verified-access-share\"\n  allow_external_principals = false\n}\n\nresource \"aws_ram_resource_association\" \"group_share\" {\n  resource_arn       = aws_verifiedaccess_group.web_apps.verified_access_group_arn\n  resource_share_arn = aws_ram_resource_share.verified_access.arn\n}\n\nresource \"aws_ram_principal_association\" \"workload_ou\" {\n  principal          = \"arn:aws:organizations::123456789012:ou\u002Fo-xxxx\u002Fou-xxxx-xxxxxxxx\"\n  resource_share_arn = aws_ram_resource_share.verified_access.arn\n}\n```\n\n## Monitoring and Logging\n\n```bash\n# Query access logs in CloudWatch\naws logs filter-log-events \\\n  --log-group-name \u002Faws\u002Fverified-access\u002Fproduction \\\n  --filter-pattern '{ $.status_code = \"403\" }' \\\n  --start-time $(date -d '1 hour ago' +%s000)\n\n# CloudWatch alarm for access denials\naws cloudwatch put-metric-alarm \\\n  --alarm-name \"VerifiedAccess-HighDenialRate\" \\\n  --metric-name \"AccessDenied\" \\\n  --namespace \"AWS\u002FVerifiedAccess\" \\\n  --statistic Sum \\\n  --period 300 \\\n  --threshold 100 \\\n  --comparison-operator GreaterThanThreshold \\\n  --evaluation-periods 2 \\\n  --alarm-actions arn:aws:sns:us-east-1:123456789012:security-alerts\n```\n\n## Security Best Practices\n\n1. **Layer policies**: Use group-level policies for broad controls and endpoint-level for app-specific restrictions\n2. **Require device trust**: Always include device posture checks in Cedar policies\n3. **Enable access logging**: Send to both CloudWatch and S3 for real-time monitoring and long-term retention\n4. **Use RAM for multi-account**: Share groups across OUs instead of duplicating configuration\n5. **Rotate OIDC secrets**: Automate client secret rotation via Secrets Manager\n6. **Test policies in non-production**: Validate Cedar policies before production deployment\n7. **Set high device trust thresholds**: Require overall score above 70 for production access\n8. **Monitor for policy drift**: Use AWS Config rules to detect unauthorized changes\n\n## References\n\n- [AWS Verified Access Documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Fverified-access\u002F)\n- [Cedar Policy Language](https:\u002F\u002Fwww.cedarpolicy.com\u002F)\n- [Building Zero Trust Across Multi-Account AWS Environments](https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fnetworking-and-content-delivery\u002Fbuilding-zero-trust-access-across-multi-account-aws-environments\u002F)\n- [Visual Guide to AWS Verified Access Setup](https:\u002F\u002Fmedium.com\u002F@chaim_sanders\u002Fa-visual-guide-to-setting-up-aws-verified-access-1333466f7222)\n- [NIST SP 800-207 Zero Trust Architecture](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-207\u002Ffinal)\n",{"name":5,"tags":44,"capec":45,"model":46,"tools":47,"domain":38,"maxTurns":51,"nist_csf":52,"subdomain":57,"description":7},[33,21,32,31,30,29,28,27,25],[],"sonnet",[48,36,49,50],"Read","Glob","Grep",20,[53,54,55,56],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Faws\u002Faccess\u002Faws\u002Faudit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill aws-access-aws-audit",{"tool":71,"command":72},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill aws-access-aws-audit",{"tool":74,"command":75},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill aws-access-aws-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Faws\u002Faccess\u002Faws\u002Faudit\u002FSKILL.md",true,[79],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"index.json","REFERENCE","参考文档",646,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Faws\u002Faccess\u002Faws\u002Faudit\u002Findex.json",[86,111,132,153,175,191],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,38,110],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[118,93,119,96,120,121,122,38,36,123,124,125,126,127,98,128,129,26,130,131],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[139,140,141,142,143,144,38,36,145,123,146,147,98,26,148,149,150,151,152,46],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":159,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[94,160,161,162,163,164,165,99,166,38,110,167,168,169,170,171,172,173,174,98],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[182,183,94,184,162,164,185,99,186,166,38,110,123,187,188,189,190,174,98,100],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":197,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[198,94,162,199,185,99,200,201,38,110,202,203,204,205,206,207,98,100,208,209],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]