View a markdown version of this page

Step 2: Author an authorization policy - AWS Client VPN

Step 2: Author an authorization policy

An authorization policy is a Cedar document that defines the requirements a connection must meet. Client VPN evaluates the policy against a context made up of three kinds of information:

  • Device signals — the health signals carried in the device posture token. Namespaces: context.crowdstrike.*, context.jamf.*, context.jumpcloud.*.

  • User identity — captured once when the device connects. Namespace depends on auth type: context.saml.*, context.active-directory.*, or context.mutual-authentication.*.

  • Connection details — always available: context.connection.* (endpoint ID, connection ID, platform, platform version, public IP address, client OpenVPN version, and AWS provided client version).

permit(principal, action, resource)
when { context.crowdstrike.assessment.overall > 50 };

For more examples, the policy API, and guidance on writing conditions, see Authoring device posture authorization policies.