# Configuring AWS Verified Access For Ztna > 配置 AWS Verified Access，使用 Cedar 策略语言通过身份和设备态势验证，为内部应用程序提供无 VPN 的零信任网络访问（ZTNA）。 - Skill: `killvxk/configuring-aws-verified-access-for-ztna` (Agent Skill, multi-file: 8 files) - Install (CLI): `npx skillmds@latest add killvxk/configuring-aws-verified-access-for-ztna` - Raw SKILL.md: https://api.skillmd.com/api/skills/killvxk/configuring-aws-verified-access-for-ztna/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - License: Apache-2.0 - Author: killvxk (https://skillmd.com/u/killvxk) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/killvxk/configuring-aws-verified-access-for-ztna --- # 为 ZTNA 配置 AWS Verified Access ## 概述 AWS Verified Access 是一项零信任网络访问（ZTNA，Zero Trust Network Access）服务，为 AWS 中托管的企业应用程序提供安全的无 VPN 访问。它使用 Cedar 策略语言编写的精细化条件访问策略实时评估每个访问请求，确保仅在满足和维持特定安全要求（如用户身份和设备安全态势）时才按应用程序授予访问权限。Verified Access 与 AWS IAM Identity Center、第三方身份提供商（Okta、CrowdStrike、JumpCloud、Jamf）及设备管理解决方案集成。对于多账户部署，AWS Resource Access Manager（RAM）支持跨组织单元共享 Verified Access 组。 ## 前置条件 - 具有适当 IAM 权限的 AWS 账户 - 身份提供商（AWS IAM Identity Center、Okta 或兼容 OIDC 的提供商） - 设备信任提供商（CrowdStrike、Jamf、JumpCloud 或 AWS Verified Access 原生） - 内部应用程序负载均衡器（ALB）或网络接口端点 - 了解 Cedar 策略语言 - 带有待保护应用程序工作负载的 VPC ## 架构 ``` 终端用户（浏览器） | | HTTPS v +------+--------+ | Verified | | Access | | 端点 | | (公共 DNS) | +------+--------+ | +------+--------+ | Verified | <-- Cedar 访问策略 | Access | <-- 身份提供商信号 | 实例 | <-- 设备信任信号 | (策略 | | 评估) | +------+--------+ | +------+--------+ | Verified | | Access 组 | | (应用组) | +------+--------+ | +------+--------+ | 内部 ALB | | 或 ENI 目标 | +------+--------+ | +------+--------+ | 应用程序 | | (私有 VPC) | +--------------+ ``` ## 核心组件 ### Verified Access 实例 评估访问请求策略的区域实体。 ```bash # 通过 AWS CLI 创建 Verified Access 实例 aws ec2 create-verified-access-instance \ --description "生产零信任实例" \ --tag-specifications 'ResourceType=verified-access-instance,Tags=[{Key=Environment,Value=production}]' ``` ### 信任提供商 #### 身份信任提供商（AWS IAM Identity Center） ```bash # 创建身份信任提供商 aws ec2 create-verified-access-trust-provider \ --trust-provider-type user \ --user-trust-provider-type iam-identity-center \ --policy-reference-name "idc" \ --description "IAM Identity Center 信任提供商" \ --tag-specifications 'ResourceType=verified-access-trust-provider,Tags=[{Key=Type,Value=identity}]' ``` #### 身份信任提供商（OIDC - Okta） ```bash aws ec2 create-verified-access-trust-provider \ --trust-provider-type user \ --user-trust-provider-type oidc \ --oidc-options '{ "Issuer": "https://company.okta.com/oauth2/default", "AuthorizationEndpoint": "https://company.okta.com/oauth2/default/v1/authorize", "TokenEndpoint": "https://company.okta.com/oauth2/default/v1/token", "UserInfoEndpoint": "https://company.okta.com/oauth2/default/v1/userinfo", "ClientId": "0oa1234567890", "ClientSecret": "client-secret-here", "Scope": "openid profile groups" }' \ --policy-reference-name "okta" \ --description "Okta OIDC 信任提供商" ``` #### 设备信任提供商（CrowdStrike） ```bash aws ec2 create-verified-access-trust-provider \ --trust-provider-type device \ --device-trust-provider-type crowdstrike \ --device-options '{ "TenantId": "crowdstrike-tenant-id", "PublicSigningKeyUrl": "https://api.crowdstrike.com/zero-trust/v2/certificates" }' \ --policy-reference-name "crowdstrike" \ --description "CrowdStrike 设备信任提供商" ``` ### 将信任提供商附加到实例 ```bash # 附加身份提供商 aws ec2 attach-verified-access-trust-provider \ --verified-access-instance-id vai-0123456789abcdef \ --verified-access-trust-provider-id vatp-0123456789abcdef # 附加设备提供商 aws ec2 attach-verified-access-trust-provider \ --verified-access-instance-id vai-0123456789abcdef \ --verified-access-trust-provider-id vatp-device123456 ``` ### Verified Access 组 ```bash # 为 Web 应用创建组 aws ec2 create-verified-access-group \ --verified-access-instance-id vai-0123456789abcdef \ --description "生产 Web 应用" \ --policy-document 'permit(principal, action, resource) when { context.okta.groups.contains("production-access") && context.crowdstrike.assessment.overall > 50 };' \ --tag-specifications 'ResourceType=verified-access-group,Tags=[{Key=Tier,Value=web}]' ``` ### Verified Access 端点 ```bash # 为基于 ALB 的应用创建端点 aws ec2 create-verified-access-endpoint \ --verified-access-group-id vag-0123456789abcdef \ --endpoint-type load-balancer \ --attachment-type vpc \ --domain-certificate-arn arn:aws:acm:us-east-1:123456789012:certificate/xxxx \ --application-domain app.internal.company.com \ --endpoint-domain-prefix myapp \ --load-balancer-options '{ "LoadBalancerArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/internal-alb/xxxx", "Port": 443, "Protocol": "https", "SubnetIds": ["subnet-abc123", "subnet-def456"] }' \ --security-group-ids sg-0123456789abcdef \ --description "内部人力资源应用" ``` ## Cedar 策略语言 ### 策略基础 ```cedar // 允许使用合规设备的工程组用户访问 permit(principal, action, resource) when { context.okta.groups.contains("engineering") && context.crowdstrike.assessment.overall > 70 && context.crowdstrike.assessment.sensor_config.status == "active" }; // 拒绝来自非托管设备的访问 forbid(principal, action, resource) when { !context.crowdstrike.assessment.sensor_config.status == "active" }; ``` ### 高级策略示例 ```cedar // 基于时间的访问 - 仅在工作时间（UTC） permit(principal, action, resource) when { context.okta.groups.contains("contractors") && context.http_request.http_method == "GET" && context.crowdstrike.assessment.overall > 80 }; // 将管理员访问限制为具有高设备信任的特定用户组 permit(principal, action, resource) when { context.idc.groups.contains("admins") && context.crowdstrike.assessment.overall > 90 && context.crowdstrike.assessment.os_version.startswith("Windows 11") || context.crowdstrike.assessment.os_version.startswith("macOS 14") }; // 为较低信任级别允许只读访问 permit(principal, action, resource) when { context.okta.groups.contains("read-only") && context.crowdstrike.assessment.overall > 30 && context.http_request.http_method == "GET" }; ``` ### 组级别与端点级别策略 ```cedar // 组级别策略（适用于组中的所有端点） // 在 Verified Access 组上设置 permit(principal, action, resource) when { context.okta.groups.contains("employees") && context.crowdstrike.assessment.overall > 50 }; // 端点级别策略（特定应用的额外限制） // 在 Verified Access 端点上设置 permit(principal, action, resource) when { context.okta.groups.contains("hr-team") && context.okta.email.endsWith("@company.com") }; ``` ## Terraform 配置 ```hcl terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 5.0" } } } # Verified Access 实例 resource "aws_verifiedaccess_instance" "main" { description = "生产零信任访问" tags = { Environment = "production" } } # 身份信任提供商（OIDC） resource "aws_verifiedaccess_trust_provider" "okta" { policy_reference_name = "okta" trust_provider_type = "user" user_trust_provider_type = "oidc" description = "Okta 身份提供商" oidc_options { authorization_endpoint = "https://company.okta.com/oauth2/default/v1/authorize" client_id = var.okta_client_id client_secret = var.okta_client_secret issuer = "https://company.okta.com/oauth2/default" scope = "openid profile groups" token_endpoint = "https://company.okta.com/oauth2/default/v1/token" user_info_endpoint = "https://company.okta.com/oauth2/default/v1/userinfo" } } # 设备信任提供商（CrowdStrike） resource "aws_verifiedaccess_trust_provider" "crowdstrike" { policy_reference_name = "crowdstrike" trust_provider_type = "device" device_trust_provider_type = "crowdstrike" description = "CrowdStrike 设备信任" device_options { tenant_id = var.crowdstrike_tenant_id } } # 将提供商附加到实例 resource "aws_verifiedaccess_instance_trust_provider_attachment" "okta" { verifiedaccess_instance_id = aws_verifiedaccess_instance.main.id verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.okta.id } resource "aws_verifiedaccess_instance_trust_provider_attachment" "crowdstrike" { verifiedaccess_instance_id = aws_verifiedaccess_instance.main.id verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.crowdstrike.id } # Verified Access 组 resource "aws_verifiedaccess_group" "web_apps" { verifiedaccess_instance_id = aws_verifiedaccess_instance.main.id description = "生产 Web 应用" policy_document = <<-CEDAR permit(principal, action, resource) when { context.okta.groups.contains("production-access") && context.crowdstrike.assessment.overall > 50 }; CEDAR tags = { Tier = "web" } } # Verified Access 端点 resource "aws_verifiedaccess_endpoint" "internal_app" { verified_access_group_id = aws_verifiedaccess_group.web_apps.id endpoint_type = "load-balancer" attachment_type = "vpc" domain_certificate_arn = aws_acm_certificate.app.arn application_domain = "app.internal.company.com" endpoint_domain_prefix = "myapp" description = "内部应用" load_balancer_options { load_balancer_arn = aws_lb.internal.arn port = 443 protocol = "https" subnet_ids = var.private_subnet_ids } security_group_ids = [aws_security_group.verified_access.id] policy_document = <<-CEDAR permit(principal, action, resource) when { context.okta.groups.contains("app-users") }; CEDAR } # 日志配置 resource "aws_verifiedaccess_instance_logging_configuration" "main" { verifiedaccess_instance_id = aws_verifiedaccess_instance.main.id access_logs { cloudwatch_logs { enabled = true log_group = aws_cloudwatch_log_group.verified_access.name } s3 { enabled = true bucket_name = aws_s3_bucket.access_logs.id prefix = "verified-access/" } } } resource "aws_cloudwatch_log_group" "verified_access" { name = "/aws/verified-access/production" retention_in_days = 90 } ``` ## 使用 AWS RAM 进行多账户部署 ```hcl # 通过 RAM 在账户间共享 Verified Access 组 resource "aws_ram_resource_share" "verified_access" { name = "verified-access-share" allow_external_principals = false } resource "aws_ram_resource_association" "group_share" { resource_arn = aws_verifiedaccess_group.web_apps.verified_access_group_arn resource_share_arn = aws_ram_resource_share.verified_access.arn } resource "aws_ram_principal_association" "workload_ou" { principal = "arn:aws:organizations::123456789012:ou/o-xxxx/ou-xxxx-xxxxxxxx" resource_share_arn = aws_ram_resource_share.verified_access.arn } ``` ## 监控和日志 ```bash # 在 CloudWatch 中查询访问日志 aws logs filter-log-events \ --log-group-name /aws/verified-access/production \ --filter-pattern '{ $.status_code = "403" }' \ --start-time $(date -d '1 hour ago' +%s000) # 访问拒绝的 CloudWatch 告警 aws cloudwatch put-metric-alarm \ --alarm-name "VerifiedAccess-HighDenialRate" \ --metric-name "AccessDenied" \ --namespace "AWS/VerifiedAccess" \ --statistic Sum \ --period 300 \ --threshold 100 \ --comparison-operator GreaterThanThreshold \ --evaluation-periods 2 \ --alarm-actions arn:aws:sns:us-east-1:123456789012:security-alerts ``` ## 安全最佳实践 1. **分层策略**：使用组级策略进行广泛控制，端点级策略进行特定应用限制 2. **要求设备信任**：始终在 Cedar 策略中包含设备态势检查 3. **启用访问日志**：同时发送到 CloudWatch 和 S3，用于实时监控和长期保留 4. **多账户使用 RAM**：跨组织单元共享组，而非复制配置 5. **轮换 OIDC 密钥**：通过 Secrets Manager 自动化客户端密钥轮换 6. **在非生产环境测试策略**：在生产部署前验证 Cedar 策略 7. **设置高设备信任阈值**：要求生产访问的整体评分高于 70 8. **监控策略漂移**：使用 AWS Config 规则检测未授权更改 ## 参考文档 - [AWS Verified Access 文档](https://docs.aws.amazon.com/verified-access/) - [Cedar 策略语言](https://www.cedarpolicy.com/) - [在多账户 AWS 环境中构建零信任访问](https://aws.amazon.com/blogs/networking-and-content-delivery/building-zero-trust-access-across-multi-account-aws-environments/) - [NIST SP 800-207 零信任架构](https://csrc.nist.gov/publications/detail/sp/800-207/final)