Achieving Zero Trust with AWS application networking
summary
Application Load Balancer handles OIDC/Cognito authentication and injects headers like X-Amzn-OIDC-AccessToken but does not enforce authorization; AWS Verified Access adds per-request authorization, device posture checks (Jamf/CrowdStrike), Cedar policies and returns a signed AVA user context header and cookie. API Gateway supports mutual TLS via an S3-hosted CA, JWT authorizers for HTTP APIs and Lambda authorizers for REST. VPC Lattice provides a regional proxy data plane, SigV4/IAM request-level auth with central revocation, traffic splitting, service directory and observability for service-to-service control.
AI-written summary · about
chapters (8)
- 0:00Introduction to concepts
- 2:09Identity management focus
- 4:33Identity use case overview
- 6:44ALB authentication
- 14:58AWS verified access
- 26:56API gateway security
- 32:03VPC lattice services
- 52:44Observability and comparison
related talks
45mZero Trusting as a True Cloud Native Dev
20mZero-Trust Security Strategy in Serverless App Deployment
59mProvably secure authorization
37mOne Auth to Rule them All: Centralizing Authentication with Azure and API Gateway
20mMitigate OWASP Top 10 for LLM risks with a Zero Trust approach
27mLeveraging Infrastructure as Code to Create Zero Trust Access to Your Apps and Infrastructure
26mZero Trust Security for your APIs
26mSuspicious Minds – Zero Trust Security for APIs