AWS Client VPN Adds Device Posture Assessment to Strengthen Access Controls

AWS added device posture assessment to its managed Client VPN service on October 5, 2026. The feature checks the security status of connecting devices before and during sessions, extending existing user authentication methods that rely on certificates, SAML or Active Directory.

How Device Posture Assessment Works in AWS Client VPN

Administrators configure trust providers on a Client VPN endpoint through the API or CLI using the --device-posture-options flag. Each provider requires a tenant identifier and signing key URL where applicable. A Cedar authorization policy then defines the required conditions, such as a minimum compliance score or specific encryption status.

The AWS VPN Client version 6.2.0 and later reads signed posture tokens from the installed agent on the endpoint device. Tokens are evaluated at connection time and again every five minutes. Devices that fail the policy are blocked from connecting or disconnected from active sessions. A shadow mode option records results without enforcement, allowing teams to test policies before activation.

The service supports multiple trust providers on the same endpoint. A built-in Test Policy tool helps validate Cedar rules before deployment. Third-party OpenVPN clients cannot participate in posture evaluation; only the AWS-provided client is supported.

Integrations with CrowdStrike, Jamf and JumpCloud

Current integrations cover CrowdStrike for macOS and Windows, Jamf for macOS, and JumpCloud for macOS, Windows and Ubuntu. These providers supply device posture tokens that include compliance scores, risk levels, disk encryption status, operating system configuration and management enrollment details.

Organizations already using one of these agents can enable the feature without additional software on endpoints. The posture data travels alongside user identity credentials, allowing policies to combine both factors. For example, a rule can require both successful SAML authentication and a CrowdStrike risk score below a defined threshold.

The capability is available in every AWS Region where Client VPN is offered and carries no extra charge. Devices must run the corresponding provider agent and remain enrolled for tokens to be generated.

Context and Next Steps for Zero Trust Deployments

Device posture assessment moves AWS Client VPN closer to Zero Trust principles by verifying both identity and device state. Continuous re-evaluation and logging provide ongoing visibility into compliance across remote access sessions.

Teams can begin by adding trust providers, writing policies in shadow mode, and reviewing logs before switching to enforcement. No further milestones have been announced by AWS. The update works alongside existing authorization rules, supporting layered access controls without replacing them.