AWS Verified Access

AWS Verified Access is a cloud service that controls access to corporate apps and infrastructure without requiring a VPN. It is best for organizations already operating in AWS that can build and maintain their own access policies. Its strongest case is request-by-request evaluation using identity and device context; usage-based charges and customer-owned configuration make it a poor fit for teams seeking a turnkey service.

Overview

Verified Access checks each application request against policies and trust data from a selected AWS or third-party provider. Requests are denied until an administrator defines a policy. That secure default makes policy design and upkeep essential, not optional. Policies can account for user identity and device security state, so a successful sign-in alone need not determine access.

The service covers HTTP(S) and TCP applications, and can provide access to AWS infrastructure resources such as EC2 instances over specified IP addresses and port ranges. That breadth is useful for organizations protecting both employee-facing apps and infrastructure, but it also leaves administrators responsible for deciding what to allow. AWS handles the cloud infrastructure; customers remain responsible for security in the cloud and for their configurations.

Key features

Identity and device context

AWS IAM Identity Center supports authentication through SAML-based third-party identity providers, and Verified Access can connect directly to custom OpenID Connect-compatible identity providers. Third-party device-management integrations contribute security and compliance context for device posture checks. AWS names integrations or partnerships with Cisco, CrowdStrike, JumpCloud, CyberArk, IBM, Datadog, JAMF, Okta, and Trellix. This ecosystem can help teams bring existing identity and device signals into access decisions, though it does not remove the work of defining policies.

Protocols, logging and administration

For non-HTTP(S) applications, users can connect through the desktop Connectivity Client; supported downloads are for Windows Intel and macOS on Apple silicon or Intel. Verified Access also supports TCP and can reach specified AWS infrastructure endpoints, making it relevant to teams that need more than browser-based app access. Data in transit from end users to its internet-facing endpoints is encrypted with TLS 1.2 or later.

Access attempts can be logged to Amazon S3, Amazon CloudWatch Logs, and Amazon Kinesis Data Firehose, with OCSF format support. That gives teams options for retaining or forwarding access records, including to SIEM workflows, but the choice and operation of those destinations remain part of their setup. Administrators can use the AWS Management Console, CLI, SDKs, or Query API, a practical range for both console-led and automated administration.

Pricing

Verified Access is paid, with charges tied to endpoint or application use and additional connection or data-processing charges. The published examples below are for US East; they are not a flat per-user subscription, so actual cost depends on usage and applicable tiers.

There is no free plan. The no-charge Connectivity Client is only a client download, not a free allowance for running Verified Access. Usage-based billing can work for teams that need its AWS-centered controls, but readers wanting predictable, per-seat pricing should account for endpoint hours, application hours, connections, and data processing before choosing it.

Platforms

Verified Access is a cloud deployment with API, Linux, macOS, web, and Windows platform support. Its Connectivity Client is a desktop app for non-HTTP(S) access, with downloads specified for Windows Intel and both Apple silicon and Intel Macs. The broader platform support does not change the client’s narrower stated download options.

Who it's for

AWS describes use cases for remote employees and external contractors, as well as IT administrators securing corporate applications and infrastructure. It is most compelling for organizations already using AWS that want identity- and device-aware rules across web and TCP services, plus access logging. Teams without the capacity to configure and maintain policies, or that want access controls managed as a ready-made package, should look elsewhere.

Pros and cons

• Pro: Evaluates every request and denies access until a policy is defined, giving administrators a clear control point rather than implicit access.
• Pro: Identity and device posture signals can inform policies, and integrations include major identity and security vendors.
• Pro: Supports HTTP(S), TCP, and specified AWS infrastructure resources, covering more than browser apps alone.
• Pro: Access logs can flow to S3, CloudWatch Logs, or Kinesis Data Firehose, with OCSF support for structured handling.
• Con: Customers must design and maintain access policies and their cloud security configuration; AWS's shared-responsibility model does not shift that work to the provider.
• Con: Pricing varies with application or endpoint hours, excess connections, and processed data, complicating budget forecasts compared with a simple seat-based plan.
• Con: The Connectivity Client is limited to specified Windows Intel and Mac downloads, which may constrain non-HTTP(S) access for users on other client platforms.

Alternatives

Cloudflare Access is a stronger candidate for teams that want a free entry point: its Free Plan costs nothing forever for under 50 users, with a $7 a month Pay-as-you-go option. Twingate also offers a free Starter plan for up to 5 users and 50 resources, which may suit a small team looking to start without usage charges. Bowtie Private Access has a free Basic plan for up to 3 users, two devices per user, and two controllers, a more bounded starting point for very small deployments.

NetBird may suit teams that prefer a free, machine-capped starting tier: its Free plan costs nothing per month for up to 5 users and 100 machines. Boundary offers a free Community Edition, so it is worth comparing when a free tier is the priority. Cloudflare Gateway has a free plan forever for 50 users with up to 24 hours of standard log retention, a concrete option for teams prioritizing a free user allowance.

Pomerium offers a Personal Free plan for 10 users, 10 routes, 5 policies, and 2 service accounts, which may fit a small deployment with those limits. OpenVPN CloudConnexa has a Starter option with 5 seats included and no credit card required, so it may be preferable for teams seeking a small seat-based starting point. Readers comparing the wider category can browse the Zero Trust Network Access Software directory.

Verdict

Choose AWS Verified Access if your organization already works in AWS and needs policy-based access to web apps, TCP services, or specified infrastructure endpoints, with identity and device context and AWS log destinations. Its request-level controls and protocol range are the main reasons to choose it. Look elsewhere if you need a free plan, simpler per-seat budgeting, or a service that does not leave policy design and cloud configuration to your team.