View a markdown version of this page

Step 3: Test the policy in shadow mode - AWS Client VPN

Step 3: Test the policy in shadow mode

Attach the policy with shadow mode enabled. In shadow mode, Client VPN evaluates the policy and records the decision in your connection logs, but never blocks a connection.

aws ec2 modify-client-vpn-endpoint-authorization-policy \
  --client-vpn-endpoint-id cvpn-endpoint-EXAMPLE \
  --policy-document 'permit(principal, action, resource) when { context.crowdstrike.assessment.overall > 50 };' \
  --description "Require CrowdStrike ZTA" \
  --shadow-mode enabled

Confirm the attached policy with get-client-vpn-endpoint-authorization-policy.