AWS Client VPN adds device posture checks before and during sessions

AWS announced device posture assessment for AWS Client VPN on October 5, 2026, adding device compliance checks before network access is granted and during active connections. The feature integrates with CrowdStrike, Jamf or JumpCloud, according to the AWS announcement.

What the feature adds

The new assessment supplements user authentication with device-security signals such as compliance scores, encryption status and risk level. Administrators define device requirements in Cedar policies, and Client VPN provides a Test Policy tool to help author and validate them.

With enforcement enabled, AWS says the feature continuously re-evaluates compliance during active sessions and automatically disconnects a session if the device falls out of compliance. These checks work alongside existing authorization rules rather than replacing them.

AWS also offers monitoring-only mode, which logs posture evaluation results without disconnecting sessions. That provides a way to assess policy impact before enforcing the requirements, according to the announcement.

Availability and requirements

AWS says device posture assessment is available in all AWS Regions where AWS Client VPN is available. It requires AWS VPN Client version 6.2.0 or later. AWS lists no additional charge for the posture assessment feature in its availability statement.

Engineering implications for rollout

The operational change is that device state can now interrupt an established connection. Teams should therefore treat posture-policy changes as potential connectivity changes, not merely login configuration.

A cautious rollout would begin in monitoring-only mode, use logged evaluations to assess likely policy impact, and validate policy definitions with Test Policy before enabling enforcement.

The announcement does not specify a re-evaluation interval or what happens when a posture provider is unreachable. Confirm those details before setting expectations for how quickly access will be revoked or designing support procedures around automatic disconnections.