本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

Verified Access Trust 資料的第三方信任提供者內容

本節說明第三方信任提供者提供給 AWS Verified Access 的信任資料。

瀏覽器延伸模組

如果您打算將裝置信任內容納入存取政策，則需要 AWS Verified Access 瀏覽器延伸模組或其他合作夥伴的瀏覽器延伸模組。Verified Access 目前支援 Google Chrome 和 Mozilla Firefox 瀏覽器。

我們目前支援三個裝置信任提供者：Jamf （支援 macOS 裝置）、 CrowdStrike （支援 Windows 11 和 Windows 10 裝置） 和 JumpCloud （同時支援 Windows 和 MacOS)。

Jamf

Jamf 是第三方信任提供者。評估政策時，如果您將 Jamf 定義為信任提供者，Verified Access 會在 Cedar 內容中包含信任資料，該內容位於信任提供者組態上指定為「政策參考名稱」的金鑰下。您可以選擇撰寫評估信任資料的政策。下列JSON結構描述顯示評估中包含哪些資料。

如需搭配驗證存取使用 Jamf 的詳細資訊，請參閱 Jamf 網站上的將AWS驗證存取與 Jamf 裝置身分整合。

{
    "title": "Jamf device data specification",
    "type": "object",
    "properties": {
        "iss": {
            "type": "string",
            "description": "\"Issuer\" - the Jamf customer ID"
        },
        "iat": {
            "type": "integer",
            "description": "\"Issued at Time\" - a unixtime (seconds since epoch) value of when the device information data was generated"
        },
        "exp": {
            "type": "integer",
            "description": "\"Expiration\" - a unixtime (seconds since epoch) value for when this device information is no longer valid"
        },
        "sub": {
            "type": "string",
            "description": "\"Subject\" - either the hardware UID or a value generated based on device location"
        },
        "groups": {
            "type": "array",
            "description": "Group IDs from UEM connector sync",
            "items": {
                "type": "string"
            }
        },
        "risk": {
            "type": "string",
            "enum": [
                "HIGH",
                "MEDIUM",
                "LOW",
                "SECURE",
                "NOT_APPLICABLE"
            ],
            "description": "a Jamf-reported level of risk associated with the device."
        },
        "osv": {
            "type": "string",
            "description": "The version of the OS that is currently running, in Apple version number format (https://support.apple.com/en-us/HT201260)"
        }
    }
}

以下是針對 Jamf 提供的信任資料進行評估的政策範例。

permit(principal, action, resource) when {
   context.jamf.risk == "LOW"
};

Cedar 提供實用的.contains()函數，可協助處理列舉，例如 Jamf 的風險分數。

permit(principal, action, resource) when {
   ["LOW", "SECURE"].contains(context.jamf.risk)
};

CrowdStrike

CrowdStrike 是第三方信任提供者。評估政策時，如果您將 CrowdStrike 定義為信任提供者，Verified Access 會在您指定為信任提供者組態上的「政策參考名稱」之金鑰下的 Cedar 內容中包含信任資料。您可以選擇撰寫評估信任資料的政策。下列JSON結構描述顯示評估中包含哪些資料。

如需 CrowdStrike 搭配 Verified Access 使用 的詳細資訊，請參閱 GitHub 網站上的使用 CrowdStrike 和 保護私有應用程式 AWS Verified Access。

{
  "title": "CrowdStrike device data specification",
  "type": "object",
  "properties": {
    "assessment": {
      "type": "object",
      "description": "Data about CrowdStrike's assessment of the device",
      "properties": {
        "overall": {
          "type": "integer",
          "description": "A single metric, between 1-100, that accounts as a weighted average of the OS and and Sensor Config scores"
        },
        "os": {
          "type": "integer",
          "description": "A single metric, between 1-100, that accounts for the OS-specific settings monitored on the host"
        },
        "sensor_config": {
          "type": "integer",
          "description": "A single metric, between 1-100, that accounts for the different sensor policies monitored on the host"
        },
        "version": {
          "type": "string",
          "description": "The version of the scoring algorithm being used"
        }
      }
    },
    "cid": {
      "type": "string",
      "description": "Customer ID (CID) unique to the customer's environemnt"
    },
    "exp": {
      "type": "integer",
      "description": "unixtime, The expiration time of the token"
    },
    "iat": {
      "type": "integer",
      "description": "unixtime, The issued time of the token"
    },
    "jwk_url": {
      "type": "string",
      "description": "URL that details the JWT signing"
    },
    "platform": {
      "type": "string",
      "enum": ["Windows 10", "Windows 11", "macOS"],
      "description": "Operating system of the endpoint"
    },
    "serial_number": {
      "type": "string",
      "description": "The serial number of the device derived by unique system information"
    },
    "sub": {
      "type": "string",
      "description": "Unique CrowdStrike Agent ID (AID) of machine"
    },
    "typ": {
      "type": "string",
      "enum": ["crowdstrike-zta+jwt"],
      "description": "Generic name for this JWT media. Client MUST reject any other type"
    }
  }
}

以下是針對 提供的信任資料進行評估的政策範例 CrowdStrike。

permit(principal, action, resource) when {
   context.crowdstrike.assessment.overall > 50
};

JumpCloud

JumpCloud 是第三方信任提供者。評估政策時，如果您將 JumpCloud 定義為信任提供者，驗證存取會在您指定為信任提供者組態上「政策參考名稱」之金鑰下的 Cedar 內容中包含信任資料。您可以選擇撰寫評估信任資料的政策。下列JSON結構描述顯示評估中包含哪些資料。

如需使用 JumpCloud 搭配 AWS Verified Access 的詳細資訊，請參閱 JumpCloud 網站上的整合 JumpCloud 和 AWS 驗證存取。

{
  "title": "JumpCloud device data specification",
  "type": "object",
  "properties": {
    "device": {
      "type": "object",
      "description": "Properties of the device",
      "properties": {
        "is_managed": {
          "type": "boolean",
          "description": "Boolean to indicate if the device is under management"
        }
      }
    },
    "exp": {
      "type": "integer",
      "description": "Expiration. Unixtime of the token's expiration."
    },
    "durt_id": {
      "type": "string",
      "description": "Device User Refresh Token ID. Unique ID that represents the device + user."
    },
    "iat": {
      "type": "integer",
      "description": "Issued At. Unixtime of the token's issuance."
    },
    "iss": {
      "type": "string",
      "description": "Issuer. This will be 'go.jumpcloud.com'"
    },
    "org_id": {
      "type": "string",
      "description": "The JumpCloud Organization ID"
    },
    "sub": {
      "type": "string",
      "description": "Subject. The managed JumpCloud user ID on the device."
    },
    "system": {
      "type": "string",
      "description": "The JumpCloud system ID"
    }
  }
}

以下是針對 提供的信任內容進行評估的政策範例 JumpCloud。

permit(principal, action, resource) when {
   context.jumpcloud.org_id = 'Unique_orgnaization_identifier'
};