Productivité · SKILL.md

configuring-aws-verified-access-for-ztna

configuring-aws-verified-access-for-ztna

配置 AWS Verified Access，使用 Cedar 策略语言通过身份和设备态势验证，为内部应用程序提供无 VPN 的零信任网络访问（ZTNA）。

Independent GitHub snapshot · Automated classification · Original documentation governs

Kkillvxk / cybersecurity-skills-zhApache-2.0

Documentation de la Skill

GitHub

name: configuring-aws-verified-access-for-ztna description: 配置 AWS Verified Access，使用 Cedar 策略语言通过身份和设备态势验证，为内部应用程序提供无 VPN 的零信任网络访问（ZTNA）。 domain: cybersecurity subdomain: zero-trust-architecture tags: [zero-trust, aws, verified-access, ztna, cedar-policy, vpn-less, identity-verification, device-posture, aws-ram] version: "1.0" author: mahipal license: Apache-2.0

为 ZTNA 配置 AWS Verified Access

概述

AWS Verified Access 是一项零信任网络访问（ZTNA，Zero Trust Network Access）服务，为 AWS 中托管的企业应用程序提供安全的无 VPN 访问。它使用 Cedar 策略语言编写的精细化条件访问策略实时评估每个访问请求，确保仅在满足和维持特定安全要求（如用户身份和设备安全态势）时才按应用程序授予访问权限。Verified Access 与 AWS IAM Identity Center、第三方身份提供商（Okta、CrowdStrike、JumpCloud、Jamf）及设备管理解决方案集成。对于多账户部署，AWS Resource Access Manager（RAM）支持跨组织单元共享 Verified Access 组。

前置条件

具有适当 IAM 权限的 AWS 账户
身份提供商（AWS IAM Identity Center、Okta 或兼容 OIDC 的提供商）
设备信任提供商（CrowdStrike、Jamf、JumpCloud 或 AWS Verified Access 原生）
内部应用程序负载均衡器（ALB）或网络接口端点
了解 Cedar 策略语言
带有待保护应用程序工作负载的 VPC

架构

    终端用户（浏览器）
         |
         | HTTPS
         v
  +------+--------+
  | Verified      |
  | Access        |
  | 端点          |
  | (公共 DNS)    |
  +------+--------+
         |
  +------+--------+
  | Verified      |  <-- Cedar 访问策略
  | Access        |  <-- 身份提供商信号
  | 实例          |  <-- 设备信任信号
  | (策略         |
  |  评估)        |
  +------+--------+
         |
  +------+--------+
  | Verified      |
  | Access 组     |
  | (应用组)      |
  +------+--------+
         |
  +------+--------+
  | 内部 ALB      |
  | 或 ENI 目标   |
  +------+--------+
         |
  +------+--------+
  | 应用程序      |
  | (私有 VPC)    |
  +--------------+

核心组件

Verified Access 实例

评估访问请求策略的区域实体。

# 通过 AWS CLI 创建 Verified Access 实例
aws ec2 create-verified-access-instance \
  --description "生产零信任实例" \
  --tag-specifications 'ResourceType=verified-access-instance,Tags=[{Key=Environment,Value=production}]'

信任提供商

身份信任提供商（AWS IAM Identity Center）

# 创建身份信任提供商
aws ec2 create-verified-access-trust-provider \
  --trust-provider-type user \
  --user-trust-provider-type iam-identity-center \
  --policy-reference-name "idc" \
  --description "IAM Identity Center 信任提供商" \
  --tag-specifications 'ResourceType=verified-access-trust-provider,Tags=[{Key=Type,Value=identity}]'

身份信任提供商（OIDC - Okta）

aws ec2 create-verified-access-trust-provider \
  --trust-provider-type user \
  --user-trust-provider-type oidc \
  --oidc-options '{
    "Issuer": "https://company.okta.com/oauth2/default",
    "AuthorizationEndpoint": "https://company.okta.com/oauth2/default/v1/authorize",
    "TokenEndpoint": "https://company.okta.com/oauth2/default/v1/token",
    "UserInfoEndpoint": "https://company.okta.com/oauth2/default/v1/userinfo",
    "ClientId": "0oa1234567890",
    "ClientSecret": "client-secret-here",
    "Scope": "openid profile groups"
  }' \
  --policy-reference-name "okta" \
  --description "Okta OIDC 信任提供商"

设备信任提供商（CrowdStrike）

aws ec2 create-verified-access-trust-provider \
  --trust-provider-type device \
  --device-trust-provider-type crowdstrike \
  --device-options '{
    "TenantId": "crowdstrike-tenant-id",
    "PublicSigningKeyUrl": "https://api.crowdstrike.com/zero-trust/v2/certificates"
  }' \
  --policy-reference-name "crowdstrike" \
  --description "CrowdStrike 设备信任提供商"

将信任提供商附加到实例

# 附加身份提供商
aws ec2 attach-verified-access-trust-provider \
  --verified-access-instance-id vai-0123456789abcdef \
  --verified-access-trust-provider-id vatp-0123456789abcdef

# 附加设备提供商
aws ec2 attach-verified-access-trust-provider \
  --verified-access-instance-id vai-0123456789abcdef \
  --verified-access-trust-provider-id vatp-device123456

Verified Access 组

# 为 Web 应用创建组
aws ec2 create-verified-access-group \
  --verified-access-instance-id vai-0123456789abcdef \
  --description "生产 Web 应用" \
  --policy-document 'permit(principal, action, resource)
    when {
      context.okta.groups.contains("production-access") &&
      context.crowdstrike.assessment.overall > 50
    };' \
  --tag-specifications 'ResourceType=verified-access-group,Tags=[{Key=Tier,Value=web}]'

Verified Access 端点

# 为基于 ALB 的应用创建端点
aws ec2 create-verified-access-endpoint \
  --verified-access-group-id vag-0123456789abcdef \
  --endpoint-type load-balancer \
  --attachment-type vpc \
  --domain-certificate-arn arn:aws:acm:us-east-1:123456789012:certificate/xxxx \
  --application-domain app.internal.company.com \
  --endpoint-domain-prefix myapp \
  --load-balancer-options '{
    "LoadBalancerArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/internal-alb/xxxx",
    "Port": 443,
    "Protocol": "https",
    "SubnetIds": ["subnet-abc123", "subnet-def456"]
  }' \
  --security-group-ids sg-0123456789abcdef \
  --description "内部人力资源应用"

Cedar 策略语言

策略基础

// 允许使用合规设备的工程组用户访问
permit(principal, action, resource)
when {
    context.okta.groups.contains("engineering") &&
    context.crowdstrike.assessment.overall > 70 &&
    context.crowdstrike.assessment.sensor_config.status == "active"
};

// 拒绝来自非托管设备的访问
forbid(principal, action, resource)
when {
    !context.crowdstrike.assessment.sensor_config.status == "active"
};

高级策略示例

// 基于时间的访问 - 仅在工作时间（UTC）
permit(principal, action, resource)
when {
    context.okta.groups.contains("contractors") &&
    context.http_request.http_method == "GET" &&
    context.crowdstrike.assessment.overall > 80
};

// 将管理员访问限制为具有高设备信任的特定用户组
permit(principal, action, resource)
when {
    context.idc.groups.contains("admins") &&
    context.crowdstrike.assessment.overall > 90 &&
    context.crowdstrike.assessment.os_version.startswith("Windows 11") ||
    context.crowdstrike.assessment.os_version.startswith("macOS 14")
};

// 为较低信任级别允许只读访问
permit(principal, action, resource)
when {
    context.okta.groups.contains("read-only") &&
    context.crowdstrike.assessment.overall > 30 &&
    context.http_request.http_method == "GET"
};

组级别与端点级别策略

// 组级别策略（适用于组中的所有端点）
// 在 Verified Access 组上设置
permit(principal, action, resource)
when {
    context.okta.groups.contains("employees") &&
    context.crowdstrike.assessment.overall > 50
};

// 端点级别策略（特定应用的额外限制）
// 在 Verified Access 端点上设置
permit(principal, action, resource)
when {
    context.okta.groups.contains("hr-team") &&
    context.okta.email.endsWith("@company.com")
};

Terraform 配置

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# Verified Access 实例
resource "aws_verifiedaccess_instance" "main" {
  description = "生产零信任访问"
  tags = {
    Environment = "production"
  }
}

# 身份信任提供商（OIDC）
resource "aws_verifiedaccess_trust_provider" "okta" {
  policy_reference_name    = "okta"
  trust_provider_type      = "user"
  user_trust_provider_type = "oidc"
  description              = "Okta 身份提供商"

  oidc_options {
    authorization_endpoint = "https://company.okta.com/oauth2/default/v1/authorize"
    client_id              = var.okta_client_id
    client_secret          = var.okta_client_secret
    issuer                 = "https://company.okta.com/oauth2/default"
    scope                  = "openid profile groups"
    token_endpoint         = "https://company.okta.com/oauth2/default/v1/token"
    user_info_endpoint     = "https://company.okta.com/oauth2/default/v1/userinfo"
  }
}

# 设备信任提供商（CrowdStrike）
resource "aws_verifiedaccess_trust_provider" "crowdstrike" {
  policy_reference_name     = "crowdstrike"
  trust_provider_type       = "device"
  device_trust_provider_type = "crowdstrike"
  description               = "CrowdStrike 设备信任"

  device_options {
    tenant_id = var.crowdstrike_tenant_id
  }
}

# 将提供商附加到实例
resource "aws_verifiedaccess_instance_trust_provider_attachment" "okta" {
  verifiedaccess_instance_id       = aws_verifiedaccess_instance.main.id
  verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.okta.id
}

resource "aws_verifiedaccess_instance_trust_provider_attachment" "crowdstrike" {
  verifiedaccess_instance_id       = aws_verifiedaccess_instance.main.id
  verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.crowdstrike.id
}

# Verified Access 组
resource "aws_verifiedaccess_group" "web_apps" {
  verifiedaccess_instance_id = aws_verifiedaccess_instance.main.id
  description                = "生产 Web 应用"

  policy_document = <<-CEDAR
    permit(principal, action, resource)
    when {
      context.okta.groups.contains("production-access") &&
      context.crowdstrike.assessment.overall > 50
    };
  CEDAR

  tags = {
    Tier = "web"
  }
}

# Verified Access 端点
resource "aws_verifiedaccess_endpoint" "internal_app" {
  verified_access_group_id = aws_verifiedaccess_group.web_apps.id
  endpoint_type            = "load-balancer"
  attachment_type          = "vpc"
  domain_certificate_arn   = aws_acm_certificate.app.arn
  application_domain       = "app.internal.company.com"
  endpoint_domain_prefix   = "myapp"
  description              = "内部应用"

  load_balancer_options {
    load_balancer_arn = aws_lb.internal.arn
    port              = 443
    protocol          = "https"
    subnet_ids        = var.private_subnet_ids
  }

  security_group_ids = [aws_security_group.verified_access.id]

  policy_document = <<-CEDAR
    permit(principal, action, resource)
    when {
      context.okta.groups.contains("app-users")
    };
  CEDAR
}

# 日志配置
resource "aws_verifiedaccess_instance_logging_configuration" "main" {
  verifiedaccess_instance_id = aws_verifiedaccess_instance.main.id

  access_logs {
    cloudwatch_logs {
      enabled   = true
      log_group = aws_cloudwatch_log_group.verified_access.name
    }
    s3 {
      enabled     = true
      bucket_name = aws_s3_bucket.access_logs.id
      prefix      = "verified-access/"
    }
  }
}

resource "aws_cloudwatch_log_group" "verified_access" {
  name              = "/aws/verified-access/production"
  retention_in_days = 90
}

使用 AWS RAM 进行多账户部署

# 通过 RAM 在账户间共享 Verified Access 组
resource "aws_ram_resource_share" "verified_access" {
  name                      = "verified-access-share"
  allow_external_principals = false
}

resource "aws_ram_resource_association" "group_share" {
  resource_arn       = aws_verifiedaccess_group.web_apps.verified_access_group_arn
  resource_share_arn = aws_ram_resource_share.verified_access.arn
}

resource "aws_ram_principal_association" "workload_ou" {
  principal          = "arn:aws:organizations::123456789012:ou/o-xxxx/ou-xxxx-xxxxxxxx"
  resource_share_arn = aws_ram_resource_share.verified_access.arn
}

监控和日志

# 在 CloudWatch 中查询访问日志
aws logs filter-log-events \
  --log-group-name /aws/verified-access/production \
  --filter-pattern '{ $.status_code = "403" }' \
  --start-time $(date -d '1 hour ago' +%s000)

# 访问拒绝的 CloudWatch 告警
aws cloudwatch put-metric-alarm \
  --alarm-name "VerifiedAccess-HighDenialRate" \
  --metric-name "AccessDenied" \
  --namespace "AWS/VerifiedAccess" \
  --statistic Sum \
  --period 300 \
  --threshold 100 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 2 \
  --alarm-actions arn:aws:sns:us-east-1:123456789012:security-alerts

安全最佳实践

分层策略：使用组级策略进行广泛控制，端点级策略进行特定应用限制
要求设备信任：始终在 Cedar 策略中包含设备态势检查
启用访问日志：同时发送到 CloudWatch 和 S3，用于实时监控和长期保留
多账户使用 RAM：跨组织单元共享组，而非复制配置
轮换 OIDC 密钥：通过 Secrets Manager 自动化客户端密钥轮换
在非生产环境测试策略：在生产部署前验证 Cedar 策略
设置高设备信任阈值：要求生产访问的整体评分高于 70
监控策略漂移：使用 AWS Config 规则检测未授权更改

参考文档

MAKE IT PART OF YOUR WORKFLOW

Installer la Skill

TERMINAL

npx skills add killvxk/cybersecurity-skills-zh --skill configuring-aws-verified-access-for-ztna

Exécutez la commande dans votre terminal. Vérifiez le code et la licence avant l’installation.

ZIP · Complete skill directory with resources and licenses

SKILL.md · Instructions file only

Étoiles du dépôt: Not synced
Licence: Apache-2.0
Version / branche: HEAD · 27418b6c
Dépôt mis à jour: Not synced

Vérifiez les scripts et les autorisations avant l’installation.

Code source