This skill guides organizations through implementing zero trust architecture in cloud environments following NIST SP 800-207 and Google BeyondCorp principles. It covers identity-centric access controls, micro-segmentation, continuous verification, device trust assessment, and deploying Identity-Aware Proxy to eliminate implicit network trust in AWS, Azure, and GCP environments.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
This skill guides organizations through implementing zero trust architecture in cloud environments following NIST SP 800-207 and Google BeyondCorp principles. It covers identity-centric access controls, micro-segmentation, continuous verification, device trust assessment, and deploying Identity-Aware Proxy to eliminate implicit network trust in AWS, Azure, and GCP environments.
When migrating from traditional perimeter-based security to identity-centric access controls
When eliminating VPN dependencies for remote workforce access to cloud applications
When implementing continuous verification for every access request regardless of network location
When designing micro-segmentation strategies for multi-cloud workloads
When regulatory requirements mandate zero trust architecture adoption (federal mandates, NIST guidelines)
Do not use for simple VPN replacement without broader architectural changes, for network firewall rule management alone (see implementing-cloud-network-segmentation), or for identity provider initial setup (see managing-cloud-identity-with-okta).
Common Misconfigurations & Verification
IAP/Verified Access bypass via direct backend reach: enabling IAP does nothing if the VM/ALB still accepts 0.0.0.0/0. For GCP confirm firewall ingress to the backend only allows the IAP range 35.235.240.0/20; for AWS confirm the target security group only allows the Verified Access ENI. Hit the backend IP directly - it must refuse.
Conditional Access excludes AllTrusted locations: a "trusted" corporate IP becomes an MFA-free hole. Verify excludeLocations does not carve out whole network ranges and that signInRiskLevels includes low, not just medium/high.
Break-glass accounts with no compensating control: policies that ExcludeUsers/ExcludeGroups for emergency accounts must still require FIDO2 and alert the SOC - confirm those exclusions are logged and monitored.
Access levels without an OS/version floor: a device policy that sets requireScreenlock but omits osConstraints minimumVersion admits unpatched endpoints. Check gcloud access-context-manager levels describe for allowedEncryptionStatuses: ["ENCRYPTED"] plus an OS floor.
Verified Access trust provider is OIDC-only: identity without a device trust provider is not zero trust. Confirm a device-type trust provider is attached and referenced in the group policy.
Access logging disabled: without modify-verified-access-instance-logging-configuration or an IAP log sink, denials are invisible. Confirm logs land in CloudWatch/BigQuery and contain / records.
decision
deny
Don't call it zero trust until the backend rejects non-proxy traffic, every app enforces MFA + compliant device, and a denied access attempt actually appears in the access logs.
Prerequisites
Identity provider capable of OIDC/SAML integration (Okta, Azure AD, Google Workspace)
Device management solution for endpoint trust assessment (Intune, Jamf, Google Endpoint Verification)
Cloud workloads accessible via HTTPS with load balancer or reverse proxy infrastructure
SIEM platform for continuous monitoring of access decisions and anomaly detection
Workflow
Step 1: Define Zero Trust Principles and Architecture
Establish the core principles following NIST SP 800-207: never trust, always verify. Every access request must be authenticated, authorized, and encrypted regardless of origin.
Configure Identity-Aware Proxy (IAP) to enforce identity and context-based access decisions before requests reach applications. Eliminate direct network access to application backends.
# GCP: Enable Identity-Aware Proxy for a backend service
gcloud services enable iap.googleapis.com
# Configure IAP for an App Engine application
gcloud iap web enable --resource-type=app-engine
# Set IAP access policy requiring specific user group
gcloud iap web add-iam-policy-binding \
--resource-type=app-engine \
--member="group:engineering@company.com" \
--role="roles/iap.httpsResourceAccessor"# Create Access Level requiring corporate device and MFA
gcloud access-context-manager levels create corporate-device \
--title="Corporate Device with MFA" \
--basic-level-spec='{
"conditions": [
{
"devicePolicy": {
"requireScreenlock": true,
"allowedEncryptionStatuses": ["ENCRYPTED"],
"osConstraints": [
{"osType": "DESKTOP_CHROME_OS", "minimumVersion": "100.0"},
{"osType": "DESKTOP_MAC", "minimumVersion": "12.0"},
{"osType": "DESKTOP_WINDOWS", "minimumVersion": "10.0.19041"}
]
},
"requiredAccessLevels": ["accessPolicies/POLICY_ID/accessLevels/require-mfa"]
}
]
}'
Configure real-time risk assessment that evaluates every access request based on identity, device posture, location, behavior patterns, and threat intelligence signals.
Integrate endpoint verification to assess device security posture before granting access. Require encryption, OS patches, and endpoint protection.
# Google Endpoint Verification with BeyondCorp
gcloud access-context-manager levels create managed-device \
--title="Managed and Encrypted Device" \
--basic-level-spec='{
"conditions": [{
"devicePolicy": {
"requireScreenlock": true,
"requireAdminApproval": true,
"allowedEncryptionStatuses": ["ENCRYPTED"],
"allowedDeviceManagementLevels": ["COMPLETE"]
}
}]
}'# Apply access level to IAP-protected resource
gcloud iap web set-iam-policy \
--resource-type=backend-services \
--service=web-app-backend \
--condition='expression=accessPolicies/POLICY_ID/accessLevels/managed-device'
Step 6: Monitor and Adapt with Continuous Analytics
Deploy logging and analytics to monitor all access decisions, detect anomalies, and continuously refine zero trust policies based on real usage patterns.
Security model that eliminates implicit trust by requiring continuous authentication, authorization, and encryption for every access request
BeyondCorp
Google's implementation of zero trust that shifts access controls from network perimeter to individual users and devices
Identity-Aware Proxy
Reverse proxy that verifies user identity and context before forwarding requests to backend applications, replacing VPN-based access
Continuous Verification
Real-time assessment of identity, device posture, location, and behavior for every access request, not just at initial authentication
Device Trust
Assessment of endpoint security posture including encryption status, OS version, patch level, and MDM compliance before granting access
NIST SP 800-207
National Institute of Standards and Technology publication defining zero trust architecture principles and deployment models
Access Context Manager
GCP service for defining conditional access policies based on device attributes, IP ranges, and identity properties
AWS Verified Access
AWS service providing zero trust application access based on identity and device trust signals without VPN
Tools & Systems
Google BeyondCorp Enterprise: End-to-end zero trust platform with Identity-Aware Proxy, Access Context Manager, and Endpoint Verification
AWS Verified Access: Zero trust application access service integrating with identity providers and device trust services
Azure Conditional Access: Policy engine enforcing identity, device, location, and risk-based access controls for Azure AD applications
Zscaler Private Access: Zero trust network access platform replacing VPN with identity and context-based application access
Cloudflare Access: Zero trust proxy for securing internal applications with identity verification and device posture checks
Common Scenarios
Scenario: Eliminating VPN for Remote Engineering Access
Context: An organization has 500 engineers accessing internal tools via VPN. The VPN concentrator is a single point of failure and recent credential theft incidents showed that VPN access grants excessive lateral movement capability.
Approach:
Inventory all internal applications accessed via VPN and classify by sensitivity level
Deploy Identity-Aware Proxy (GCP) or Verified Access (AWS) in front of each application
Configure OIDC integration with the corporate identity provider requiring MFA for all access
Implement device trust policies requiring encrypted devices with current OS patches and endpoint protection
Enable continuous session evaluation with 4-hour re-authentication for sensitive applications
Gradually migrate teams from VPN to IAP access, monitoring for access failures and adjusting policies
Decommission VPN after 100% migration and 30-day parallel operation period
Pitfalls: Deploying zero trust without device management in place blocks legitimate users with personal devices. Setting re-authentication intervals too short disrupts developer productivity with excessive login prompts.
Output Format
Zero Trust Architecture Assessment Report
===========================================
Organization: Acme Corp
Cloud Providers: AWS, Azure, GCP
Assessment Date: 2025-02-23
MATURITY LEVEL: Level 2 (Advanced) - NIST ZTA Maturity Model
IDENTITY PILLAR:
MFA Enforcement: 98% of users (target: 100%)
Phishing-Resistant MFA: 34% (target: 80%)
SSO Coverage: 87% of applications
Conditional Access Policies: 12 active policies
DEVICE PILLAR:
MDM Enrollment: 92% of corporate devices
Encryption Enforcement: 95%
OS Patch Compliance: 78% (30-day window)
Endpoint Protection: 96%
NETWORK PILLAR:
VPN Dependency: 3 applications remaining (target: 0)
IAP-Protected Applications: 47/50
Micro-Segmented Workloads: 65%
East-West Traffic Encryption: 40% (mTLS adoption)
APPLICATION PILLAR:
Applications Behind Zero Trust Proxy: 94%
Session Re-Authentication: Configured for 85% of apps
Runtime Access Logging: 100%
RECOMMENDATIONS:
1. [HIGH] Migrate remaining 3 VPN-dependent apps to IAP
2. [HIGH] Increase phishing-resistant MFA to 80% within 6 months
3. [MEDIUM] Expand micro-segmentation to remaining 35% of workloads
4. [MEDIUM] Deploy service mesh for east-west mTLS encryption
