Steps toward a Zero Trust architecture on AWS
summary
Covers concrete Zero Trust patterns on AWS and new managed tools that simplify doing the work: identity-signed calls with SigV4 (AWS IAM signs ~1 billion requests/sec), network controls with PrivateLink and VPC endpoints, and orchestration via VPC Lattice which creates 169.254 link‑local routers for one‑way, unroutable service paths across VPCs. Adds browser‑based device posture and per‑request auth with AWS Verified Access, instance/session management via Systems Manager, and fine‑grained policies using Amazon Verified Permissions (CDER). Demonstrations show these pieces integrate and scale.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:17The fundamental underlying question
- 3:49Zero Trust in real life
- 6:02Avoid a binary choice
- 8:32Expanding set of use cases
- 8:58One size doesn't fit all
- 11:09AWS services interacting with each other
- 20:15Securing hybrid workloads
- 23:35Rethinking service-to-service communications
- 26:34Amazon VPC Lattice - How does it work?
- 32:54Enabling friction-free access to internal applications
- 37:57AWS Verified Access - How does it work?
- 44:20Admin access with AWS Systems Manager
- 48:07Building permissions system: Must-haves
- 49:28Cedar policy language: RBAC + ABAC
- 53:53Parallel app modernization tracks
related talks
01h 02mIntroduction to Zero Trust Security
27mLeveraging Infrastructure as Code to Create Zero Trust Access to Your Apps and Infrastructure
42mZero Trust security with HashiCorp Vault and AWS (PRT239)
45mZero Trust: Getting to Step One..and What to Do When You Get There
18mImplementing Zero Trust at Enterprise Scale
49mZero Trust Security
35mDemystifying Zero-Trust for Cloud Native Technologies
47mSecure access to AWS with ZTNA 2.0