# AWS Client VPN adds device posture checks before and during sessions > AWS Client VPN can check device compliance before access and disconnect noncompliant sessions, with monitoring-only mode available to assess policy impact. Canonical URL: https://www.devobs.io/news/news-event-0bae0f76d015778620cc2b5d/ By: Ines Costa Published: 2026-10-06T07:38:43.469Z Updated: 2026-10-06T07:38:43.469Z Event date: 2026-10-05 Section: Security AWS announced device posture assessment for AWS Client VPN on October 5, 2026, adding device compliance checks before network access is granted and during active connections. The feature integrates with CrowdStrike, Jamf or JumpCloud, according to the [AWS announcement](https://aws.amazon.com/about-aws/whats-new/2026/10/aws-client-vpn-device-posture/). ## What the feature adds The new assessment supplements user authentication with device-security signals such as compliance scores, encryption status and risk level. Administrators define device requirements in Cedar policies, and Client VPN provides a Test Policy tool to help author and validate them. With enforcement enabled, AWS says the feature continuously re-evaluates compliance during active sessions and automatically disconnects a session if the device falls out of compliance. These checks work alongside existing authorization rules rather than replacing them. AWS also offers monitoring-only mode, which logs posture evaluation results without disconnecting sessions. That provides a way to assess policy impact before enforcing the requirements, according to the [announcement](https://aws.amazon.com/about-aws/whats-new/2026/10/aws-client-vpn-device-posture/). ## Availability and requirements AWS says device posture assessment is available in all AWS Regions where AWS Client VPN is available. It requires **AWS VPN Client version 6.2.0 or later**. AWS lists **no additional charge for the posture assessment feature** in its [availability statement](https://aws.amazon.com/about-aws/whats-new/2026/10/aws-client-vpn-device-posture/). ## Engineering implications for rollout The operational change is that device state can now interrupt an established connection. Teams should therefore treat posture-policy changes as potential connectivity changes, not merely login configuration. A cautious rollout would begin in monitoring-only mode, use logged evaluations to assess likely policy impact, and validate policy definitions with Test Policy before enabling enforcement. The announcement does not specify a re-evaluation interval or what happens when a posture provider is unreachable. Confirm those details before setting expectations for how quickly access will be revoked or designing support procedures around automatic disconnections. ## Source references -