Practical Perimeter-less authentication solutions for Startups using AWS native solutions

The speaker, a security consultant who works with small and medium businesses, argues that VPN-based perimeters fall short for cloud-hosted companies. Long-lived credentials such as SSH keys, user passwords and VPN configs create many entry points, and firms with tight budgets often lack the resources for a full zero trust rollout. The talk frames zero trust as continuous authentication and authorization driven by device, network, identity and permission signals.

Demos cover AWS Systems Manager working with IAM Identity Center. Engineers sign in with federated credentials and MFA, receive temporary credentials, and reach instances over SSM sessions, port forwarding to an internal web server, and a tunnel to a private MySQL database that closes when the session ends. For internal web apps, the talk then shows AWS Verified Access, which applies a policy check without a VPN. Its per-endpoint, per-hour pricing is presented as the main obstacle for small teams, and grouping apps behind a load balancer or tearing endpoints down outside working hours are offered as ways to reduce spend.

The closing advice is that zero trust controls matter even for small companies, that SSM is worth exploring because it adds little or no cost, and that Verified Access suits web tools such as a dev server or an internal Jenkins instance rather than database access. The speaker's final point is that strong controls depend more on intent than on money.