Zero Trust Application Access across clouds
Identity-based access to internal web applications without a VPN - Verified Access, Cloudflare Access, Identity-Aware Proxy - where the proxy checks who you are and what device you are on before the application sees a request.
3 verified modules - all static-validated and publish-checked; live-test pending.
Compare by provider
| Provider | Module | Verification |
|---|---|---|
| AWS | Verified Access (VPN-less Application Access) | static-validated |
| Cloudflare | Cloudflare Zero Trust Access | static-validated |
| Google Cloud | IAP in Front of a Web Backend: Who Gets Through, How Often They Prove It | static-validated |
How to choose
Compare where the identity comes from (the cloud IdP, any OIDC provider, a Google account), whether device posture can be part of the decision, what the application has to do to trust the proxy (verify a signed header, or nothing), and what it costs per user or per application.
When not to use
The proxy protects one path. An application that still answers on its own address, from another load balancer, or over the old VPN is protected on paper; the module that puts the proxy in front is half the work, and closing the other doors is the other half.