Step 1: Select filters and test the policy
In the Test policy view, you select filters to load a connection's context, then edit and test your policy against that context. The Client VPN endpoint is selected automatically. You can set the following filters:
-
Authorization decision (required) — the most recent allow or deny decision to use from the connection logs.
-
Device identifier (optional) — the unique device identifier.
-
User (optional) — the user identifier.
-
Operating system (optional) — the device operating system.
To select filters and test a policy
-
Open the Amazon VPC console at https://console.aws.amazon.com/vpc/
. -
In the navigation pane, choose Client VPN endpoints, then choose the endpoint ID for the endpoint you want to work with.
-
Choose the Authorization tab, then choose Test policy.
-
Set Authorization decision, which is required. Optionally, set Device identifier, User, and Operating system.
-
Choose Search connections. Test policy displays the trust context sent by your device trust provider, the user identity context, and the Cedar authorization policy for the Client VPN endpoint.
-
Review the trust context alongside the policy. Edit the Cedar policy, then choose Test policy to evaluate it against the loaded context. Repeat until you are satisfied with the result.
-
Choose Save.
Note
The trust and identity contexts are static. You can view them alongside the policy to understand what data is available for your policy conditions, but you cannot edit them.
