Guides zero trust implementation across AWS, Azure, and GCP per NIST SP 800-207 and BeyondCorp principles, covering identity-centric access, micro-segmentation, continuous verification, device trust assessment, and Identity-Aware Proxy deployment. Use when migrating from perimeter security to identity-centric access, removing VPN dependency, or designing micro-segmentation for multi-cloud workloads.
Guides zero trust implementation across AWS, Azure, and GCP per NIST SP 800-207 and BeyondCorp principles, covering identity-centric access, micro-segmentation, continuous verification, device trust assessment, and Identity-Aware Proxy deployment. Use when migrating from perimeter security to identity-centric access, removing VPN dependency, or designing micro-segmentation for multi-cloud workloads.
When migrating from traditional perimeter-based security to identity-centric access controls
When eliminating VPN dependencies for remote workforce access to cloud applications
When implementing continuous verification for every access request regardless of network location
When designing micro-segmentation strategies for multi-cloud workloads
When regulatory requirements mandate zero trust architecture adoption (federal mandates, NIST guidelines)
Do not use for simple VPN replacement without broader architectural changes, for network firewall rule management alone (see implementing-cloud-network-segmentation), or for identity provider initial setup (see managing-cloud-identity-with-okta).
Prerequisites
Identity provider capable of OIDC/SAML integration (Okta, Azure AD, Google Workspace)
Device management solution for endpoint trust assessment (Intune, Jamf, Google Endpoint Verification)
Cloud workloads accessible via HTTPS with load balancer or reverse proxy infrastructure
SIEM platform for continuous monitoring of access decisions and anomaly detection
Workflow
Step 1: Define Zero Trust Principles and Architecture
Establish the core principles following NIST SP 800-207: never trust, always verify. Every access request must be authenticated, authorized, and encrypted regardless of origin.
Configure Identity-Aware Proxy (IAP) to enforce identity and context-based access decisions before requests reach applications. Eliminate direct network access to application backends.
Configure real-time risk assessment that evaluates every access request based on identity, device posture, location, behavior patterns, and threat intelligence signals.
Integrate endpoint verification to assess device security posture before granting access. Require encryption, OS patches, and endpoint protection.
# Google Endpoint Verification with BeyondCorp
gcloud access-context-manager levels create managed-device \
--title="Managed and Encrypted Device" \
--basic-level-spec='{
"conditions": [{
"devicePolicy": {
"requireScreenlock": true,
"requireAdminApproval": true,
"allowedEncryptionStatuses": ["ENCRYPTED"],
"allowedDeviceManagementLevels": ["COMPLETE"]
}
}]
}'# Apply access level to IAP-protected resource
gcloud iap web set-iam-policy \
--resource-type=backend-services \
--service=web-app-backend \
--condition='expression=accessPolicies/POLICY_ID/accessLevels/managed-device'
Step 6: Monitor and Adapt with Continuous Analytics
Deploy logging and analytics to monitor all access decisions, detect anomalies, and continuously refine zero trust policies based on real usage patterns.
Security model that eliminates implicit trust by requiring continuous authentication, authorization, and encryption for every access request
BeyondCorp
Google's implementation of zero trust that shifts access controls from network perimeter to individual users and devices
Identity-Aware Proxy
Reverse proxy that verifies user identity and context before forwarding requests to backend applications, replacing VPN-based access
Continuous Verification
Real-time assessment of identity, device posture, location, and behavior for every access request, not just at initial authentication
Device Trust
Assessment of endpoint security posture including encryption status, OS version, patch level, and MDM compliance before granting access
NIST SP 800-207
National Institute of Standards and Technology publication defining zero trust architecture principles and deployment models
Access Context Manager
GCP service for defining conditional access policies based on device attributes, IP ranges, and identity properties
AWS Verified Access
AWS service providing zero trust application access based on identity and device trust signals without VPN
Tools & Systems
Google BeyondCorp Enterprise: End-to-end zero trust platform with Identity-Aware Proxy, Access Context Manager, and Endpoint Verification
AWS Verified Access: Zero trust application access service integrating with identity providers and device trust services
Azure Conditional Access: Policy engine enforcing identity, device, location, and risk-based access controls for Azure AD applications
Zscaler Private Access: Zero trust network access platform replacing VPN with identity and context-based application access
Cloudflare Access: Zero trust proxy for securing internal applications with identity verification and device posture checks
Common Scenarios
Scenario: Eliminating VPN for Remote Engineering Access
Context: An organization has 500 engineers accessing internal tools via VPN. The VPN concentrator is a single point of failure and recent credential theft incidents showed that VPN access grants excessive lateral movement capability.
Approach:
Inventory all internal applications accessed via VPN and classify by sensitivity level
Deploy Identity-Aware Proxy (GCP) or Verified Access (AWS) in front of each application
Configure OIDC integration with the corporate identity provider requiring MFA for all access
Implement device trust policies requiring encrypted devices with current OS patches and endpoint protection
Enable continuous session evaluation with 4-hour re-authentication for sensitive applications
Gradually migrate teams from VPN to IAP access, monitoring for access failures and adjusting policies
Decommission VPN after 100% migration and 30-day parallel operation period
Pitfalls: Deploying zero trust without device management in place blocks legitimate users with personal devices. Setting re-authentication intervals too short disrupts developer productivity with excessive login prompts.
Output Format
Zero Trust Architecture Assessment Report
===========================================
Organization: Acme Corp
Cloud Providers: AWS, Azure, GCP
Assessment Date: 2025-02-23
MATURITY LEVEL: Level 2 (Advanced) - NIST ZTA Maturity Model
IDENTITY PILLAR:
MFA Enforcement: 98% of users (target: 100%)
Phishing-Resistant MFA: 34% (target: 80%)
SSO Coverage: 87% of applications
Conditional Access Policies: 12 active policies
DEVICE PILLAR:
MDM Enrollment: 92% of corporate devices
Encryption Enforcement: 95%
OS Patch Compliance: 78% (30-day window)
Endpoint Protection: 96%
NETWORK PILLAR:
VPN Dependency: 3 applications remaining (target: 0)
IAP-Protected Applications: 47/50
Micro-Segmented Workloads: 65%
East-West Traffic Encryption: 40% (mTLS adoption)
APPLICATION PILLAR:
Applications Behind Zero Trust Proxy: 94%
Session Re-Authentication: Configured for 85% of apps
Runtime Access Logging: 100%
RECOMMENDATIONS:
1. [HIGH] Migrate remaining 3 VPN-dependent apps to IAP
2. [HIGH] Increase phishing-resistant MFA to 80% within 6 months
3. [MEDIUM] Expand micro-segmentation to remaining 35% of workloads
4. [MEDIUM] Deploy service mesh for east-west mTLS encryption
