View a markdown version of this page

Setting up a device trust provider - AWS Client VPN
PrerequisitesCrowdStrikeJamfJumpCloudWhat to expect

Setting up a device trust provider

If your administrator has enabled device posture on a Client VPN endpoint, your device must have a supported device trust provider configured. The device trust provider makes a device posture token available on your device, which the AWS provided client reads when you connect.

This page describes the prerequisites for device posture and how to set up each supported provider on your device.

Prerequisites

Before you set up a device trust provider, make sure you have the following.

  • The AWS provided client, version 6.2.0 or later.

  • An administrator who has enabled device posture on the Client VPN endpoint that you connect to.

  • A client configuration (.ovpn) file that contains the device posture directive. Your administrator provides this file.

CrowdStrike

Supported platforms

macOS, Windows

Install the CrowdStrike Falcon sensor on your device. Your organization's IT administrator typically deploys this.

For more information, see CrowdStrike Zero Trust Assessment on the provider's website.

Jamf

Supported platforms

macOS

Minimum agent version

Jamf Trust 2.26.0

Enroll your macOS device in Jamf Pro. Your organization's IT administrator typically handles enrollment.

For more information, see Jamf Trusted Access on the provider's website.

JumpCloud

Supported platforms

macOS, Windows, Ubuntu

Minimum agent version

JumpCloud Agent 2.144.3

Install the JumpCloud agent on your device. Your organization's IT administrator typically deploys this.

For more information, see JumpCloud Device Trust on the provider's website.

What to expect when connecting

When you connect to a Client VPN endpoint that has device posture enabled, the AWS provided client reads the device posture token from your device trust provider and sends it to Client VPN for evaluation. If your device meets the requirements in your administrator's authorization policy, the connection proceeds normally.

If your device does not meet the requirements, Client VPN rejects the connection and the AWS provided client displays the message Authorization policy evaluation failed. If you see this message, contact your administrator.