Security is the cornerstone of modern organizations and a crucial part
of protecting their applications, data and reputation.
It was not that difficult when their applications hosted in on-premises
data centers and accessed from the corporate buildings. As enterprises moved
their workload to cloud and employees started working remotely,
it's a big challenge for the organizations to securely grant access to their applications.
Employees need to access applications by VPN.
Organizations need to add security policy at multiple levels to secure their
applications, like VPN policy, device policy, and application policy.
These policies are managed by different teams and potentially creating overlaps,
making it difficult to diagnose any application access issues.
It takes months and a lot of coordination between different teams
to roll out any policy update.
AWS’ new product, AWS Verified Access will help you to overcome these challenges,
and makes your applications secure.
Hi, my name is Ankush Goyal, and I'm a Senior Technical Account Manager at AWS,
and in this video I will talk about a new service, AWS Verified Access,
also known as AVA.
AVA helps employees access the corporate applications over the Internet
without requiring a VPN, and helps organizations to manage
policy at a single place.
AVA is built using Zero Trust security principles.
Zero Trust is a security model based on the principle of maintaining
strict access controls and not trusting any entity by default.
AVA helps organizations to improve their security posture by leveraging multiple
security inputs and grants access to applications when user and their device
meet the specified security requirements.
It validates each access request regardless of user, network, or location
before granting the access.
AVA helps organizations to manage policy at a central place instead of managing
at different levels.
It also integrates with AWS Web Application Firewall, also known as WAF.
WAF helps customers to filter out common exploits, such as
SQL injection and cross-site scripting.
Now let’s see this in action, and see how you can create AVA in your console.
In this demo, first we will see how you can control access
to your corporate applications
by using AWS Verified Access policies.
And then we will see how you can integrate WAF with AWS Verified Access.
For this demo, I've already created a Verified Access instance
where I will be using IAM Identity Center as my trust provider.
I also created a Verified Access group for my HR application where I have a policy
saying that any user who belonged to my HR user group
and has an email address of Amazon dot com should be able
to access this application.
I have also created an end point for my HR application which we will use
to access this application.
On the IAM Identity Center site, I've created a HR group which has two users,
HR underscore Amazon underscore user. And HR underscore AWS underscore user.
One of the users has an email address ending with Amazon dot com.
Other user has an email address ending with the AWS dot com.
So based on our AWS Verified Access policy, my user with an email address
ending in Amazon dot com should be able to access that corporate application,
where the other user should not be able to access the corporate application.
Next we will go to a separate browser where we will try to access this application
by using our AWS Verified Access endpoint.
I’ve opened a separate private browser where I will try to access this application
by using my Verified Access endpoint.
I will enter the user name of the user which is Amazon dot com as an email address.
Now we see this user is able to access the HR application because the email address
for this user is Amazon dot com,
and the user belongs to the HR group which satisfies the condition we have
written out in the AWS Verified Access policy.
Next, we will try to log in by using the other user which is AWS dot com
as the email address.
I have again opened a private browser. We will try to access this application
by using the AWS Verified Access endpoint.
I will enter the username of the user which is AWS dot com as the email address.
As you see, this user has AWS dot com as an email address is not able to
access this application and we're getting 403 Unauthorized error message.
Next, let's see how you can integrate AWS WAF with AWS Verified Access instance.
For that go to Verify Access instance console and click on Integrations tab.
Here you have two options, either you can create a new Web ACL,
but if you've already created an ACL,
then you can click on Action and Associate Web ACL.
Select the Web ACL you have created and click on Associate Web ACL.
You can also integrate AWS WAF with AWS Verified Access instance from AWS WAF web console.
For that, go to AWS WAF web console and open the Web ACL you want to integrate.
Open the Web ACL, click on Associated AWS resources, and click on
Add AWS resources.
Here select AWS Verified Access and then click the Verified Access instance
and click on Add.
Under this Web ACL I have block any SQL injection related queries.
Next, we'll try to log in to our Sales application, and we'll see how
WAF can help us to block any SQL injection attempts.
I open a private browser where I'm trying to access my Sales application,
by passing the parameter customer ID.
And I'm trying to access all the customer data from the database.
It should be identified as a SQL injection attack by WAF and should be blocked.
You can see this request has been blocked by WAF and not even going to your
IAM Identity Center for any authentication.
You can find more details about this blocked request under CloudWatch logs for this WAF.
For that go to CloudWatch logs and open WAF logs and go to the Log stream.
You will find details like terminatingRuleID and RuleMatchDetails,
like for in our case it was a SQL injection and what parameters was sent in the URL.
Now let's change the customer ID a valid customer ID and see what happens.
Now I'm using a valid customer ID here.
So the one where I use a valid customer ID, it's getting allowed by WAF because it's not
a SQL injection and it's going to my IAM Identity Center to enter
my ID and password.
And you will see you got those results by using the valid customer ID.
In this video, we explained the challenges customers often face
when working remotely.
And how AVA can help by providing secure access to your applications
without requiring a VPN.
We covered how AWS WAF can enhance security for you and applications,
and block any malicious requests before it reaches to your application.
In this demo, we saw how AVA policies can be used to control access
for your corporate applications and how easy it is to integrate AWS WAF with AVA.
Please check the links in the description below
to learn more about AWS Verified Access.
Thank you so much for watching.