
AWS Verified Access improved logging now captures extensive user context from trust providers, enabling administrators to write and troubleshoot fine-grained zero-trust access policies more efficiently.


<div><p>This article explains how to use improved AWS Verified Access logging to write and troubleshoot zero-trust access policies for corporate applications without VPNs.</p><ul><li>Verified Access now logs extensive user context from trust providers for better policy troubleshooting</li><li>Enable logging via console by selecting OCSF log version and including trust context</li><li>Logs capture user identity, group membership, device security scores, and HTTP request details</li><li>Different trust providers (IAM Identity Center, Okta, CrowdStrike) provide different context information</li><li>Use detailed context to write fine-grained policies with multiple validation conditions</li><li>Example policy checks group membership, email verification, device OS score, and overall device score</li></ul><p>The improved logging eliminates manual context gathering from multiple sources, enabling faster policy development and security incident response.</p></div>


Related articles