Guide · Agent skill

How to use the AWS Verified Access ZTNA Setup agent skill

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

This guide explains what the configuring-aws-verified-access-for-ztna agent skill does, how to install it for Claude, and how to ask it for help. It is aimed at cloud and security engineers who want to replace a VPN with zero trust access to internal web apps on AWS. You do not need prior experience with agent skills to follow it.

AWS Verified Access ZTNA Setupmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill

Quick start

1Download and unzip the skill. Download the ZIP file from this page and unzip it. Keep the folder name configuring-aws-verified-access-for-ztna.
2Place it where Claude can find it. Move the folder into ~/.claude/skills/ for personal use or into .claude/skills/ in a project. Alternatively, upload it in the Claude apps under Settings → Capabilities → Skills.
3Install the prerequisites. Install Python 3 and boto3 with pip install boto3, and make sure the AWS CLI is available with IAM permissions for Verified Access.
4Ask a specific request. Describe your goal, such as replacing VPN access for one internal app, and name your identity and device providers so the agent can tailor its steps.
5Review the generated policies and commands. Check every Cedar policy, CLI command and script output against your security requirements before running anything in an AWS account.
6Test in a non-production account. Deploy the instance, groups and endpoints first in a test environment, verify that access is granted and denied as intended, and then plan any production change with review.

What does this skill make the agent do?

AWS Verified Access is a zero trust network access (ZTNA) service. It gives people secure access to corporate applications hosted in AWS without a VPN. Each request is evaluated against conditional access policies written in the Cedar policy language, and access is granted per application only when requirements such as user identity and device security posture are met.

Once the skill is installed, the agent can walk you through configuring this setup. The skill's documentation covers Verified Access instances, identity trust providers (IAM Identity Center and Okta over OIDC), device trust providers (CrowdStrike and Jamf), groups, endpoints, Cedar policy authoring, and Terraform deployment. For multi-account deployments it mentions AWS Resource Access Manager (RAM) for sharing groups across organizational units.

Explains the components: instance, trust providers, groups and endpoints
Drafts Cedar permit and forbid policies that check identity and device signals
Includes Python helper scripts (scripts/agent.py and scripts/process.py) that use boto3 to list existing Verified Access resources and generate Cedar policy text
Includes a deployment checklist template (assets/template.md)

How do you install the skill?

Download the ZIP file from this page and unzip it. For a personal setup, place the unzipped folder inside ~/.claude/skills/. For a single project, place it inside that project's .claude/skills/ folder so it applies only there.

If you use the Claude apps instead, you can upload the skill there under Settings → Capabilities → Skills.

Personal install: ~/.claude/skills/
Project install: .claude/skills/ inside your project folder
Claude apps: Settings → Capabilities → Skills, then upload the skill

Check the requirements before you start

The skill assumes you already run workloads on AWS. Its examples and policies apply only to Verified Access, so they will not help an organization that is not using AWS. The skill lists the following prerequisites, and you should have them ready before creating any resources.

Python 3 with boto3, installed by running: pip install boto3
An AWS account with IAM permissions for Verified Access (EC2 API)
AWS CLI, for the example commands
An identity provider such as IAM Identity Center or Okta, using OIDC client credentials
A device trust provider such as CrowdStrike or Jamf
An internal Application Load Balancer and an ACM certificate
A VPC with the application workloads you want to protect

How do you trigger the skill with natural requests?

You do not need a special command. Describe the task in plain language and mention AWS Verified Access, ZTNA, VPN replacement, or Cedar. The skill's description says it applies when you are replacing VPN access with ZTNA, writing Cedar access policies, or deploying Verified Access instances, groups, and endpoints across AWS accounts.

Be specific about your goal and your environment. Naming your identity provider, device trust provider, and application helps the agent choose the right parts of the skill.

Replace our VPN for the internal HR app with Verified Access. We use Okta and CrowdStrike.
Write a Cedar policy that lets engineering users in with a compliant device and blocks unmanaged devices.
List the Verified Access instances, groups and endpoints in my AWS account.
Create a deployment checklist for Verified Access across two AWS accounts using RAM.

What does the example setup look like?

The skill's main example creates a Verified Access instance with the AWS CLI. Replace the sample tag values with your own before running anything, and treat the command as a template rather than something to paste unchanged.

Other steps in the skill follow the same pattern: create identity and device trust providers, attach them to the instance, create a group with a Cedar policy, then create an endpoint that points to your internal ALB.

Trust providers are created with aws ec2 create-verified-access-trust-provider and attached with aws ec2 attach-verified-access-trust-provider
Groups are created with aws ec2 create-verified-access-group and hold the Cedar policy document
Endpoints are created with aws ec2 create-verified-access-endpoint and link a group to an internal application domain

aws ec2 create-verified-access-instance \
  --description "Production Zero Trust Instance" \
  --tag-specifications 'ResourceType=verified-access-instance,Tags=[{Key=Environment,Value=production}]'

What do the Cedar policies look like?

Cedar policies are written as permit or forbid rules with a when condition. The skill's examples check group membership from the identity provider and a device score from the device trust provider. A permit rule grants access only when its conditions are true, and a forbid rule can block access from devices that fail a check.

Read every condition carefully before you deploy it. Operators such as && and || can combine in ways that differ from how a line looks on screen, and the skill's examples use placeholder group names and thresholds that you must set for your own organization.

Example: permit engineering users when the device score is above 70 and the sensor status is active
Example: forbid access from devices whose sensor is not active
Example: read-only access for lower trust levels with a score above 30

permit(principal, action, resource)
when {
    context.okta.groups.contains("engineering") &&
    context.crowdstrike.assessment.overall > 70 &&
    context.crowdstrike.assessment.sensor_config.status == "active"
};

What safety points should you know?

This skill runs scripts and uses the network. The helper scripts call AWS through boto3, and the commands in the skill create real cloud resources. If they are misconfigured, internal applications can be exposed.

The examples use placeholder IDs and an inline client secret. Do not store real secrets in policy files, scripts, or chat messages. Use your own secret handling process, and review every generated policy and command before you run it in an AWS account.

Test in a non-production AWS account first
Review all Cedar policies with a second engineer before deploying
Never leave the example client secret in place; replace it with your own secret handling
Confirm the ALB, security groups and ACM certificate point to the applications you intend to expose
Check the agent's commands and scripts before running them, since they can create or change resources

What people use it for

Replacing VPN access to an internal HR or finance web app with per-application zero trust access
Writing Cedar policies that combine Okta group membership with a CrowdStrike device score
Auditing existing Verified Access instances, groups and endpoints in an AWS account with the helper scripts
Sharing Verified Access groups across several AWS accounts with AWS Resource Access Manager (RAM)
Learning how zero trust network access is configured in AWS as a student

Frequently asked questions

How do I install the configuring-aws-verified-access-for-ztna skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.

What do I need to use the AWS Verified Access ZTNA skill?

You need an AWS account with IAM permissions for Verified Access, Python 3 with boto3, the AWS CLI for the example commands, an identity provider such as IAM Identity Center or Okta, a device trust provider such as CrowdStrike or Jamf, an internal Application Load Balancer, and an ACM certificate.

Is this skill free to use?

The skill is listed under the Apache-2.0 licence. The source does not state any price. AWS charges for the resources you create, which the source does not quantify.

Can I use this skill if I am not on AWS?

No. The skill is specific to AWS Verified Access, and its policies and commands would not apply to an organization that does not run workloads on AWS.

What should I do if the helper scripts fail because boto3 is missing?

Install boto3 with pip install boto3 and confirm you are running Python 3. The skill's prerequisites list boto3 as a requirement for the scripts.

How does this compare with a traditional VPN?

The skill is designed to replace VPN access with zero trust access, where each request is checked against policies covering user identity and device health. The source does not compare it with other ZTNA products, so evaluate those separately.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits cloud and security engineers moving internal app access on AWS away from a VPN, and students learning how Verified Access is configured. It is not suitable for organizations outside AWS, or for anyone who will apply the examples to production without testing and review, because the commands create real resources and the examples contain placeholder values.

Download the skill