Can I allow AWS Access Portal access only from specific devices?

Question

Hi all

I created AWS Control Tower and am using AWS Identity Center for user management. I'm looking for a solution that can allow AWS Access Portal access only from specific devices? Is this possible? Is there any 3rd part Idp that support that?

I saw a post - https://repost.aws/questions/QUwEJUlZ1ZSkijpxkfHWtV0g/aws-access-portal-url-sso-login-url-restricting-access-to-vpn, but this is not what I wanted. I don't want to show even the AWS Portal if the user is not using a specific device.

Thanks.

Riku_Kobayashi · Accepted Answer

Hello.

If you are using the IAM Identity Center directly, as of May 2025, it is not possible to restrict access to the Access Portal by device.  
This may be possible if you use an external IdP for authentication (such as Azure Entra ID).  
https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview  
> * Device
>   * Users with devices of specific platforms or marked with a specific state can be used when enforcing Conditional Access policies.
>   * Use filters for devices to target policies to specific devices like privileged access workstations.

re:Post Agent · Answer

While AWS Identity Center (formerly AWS Single Sign-On) doesn't natively support device-specific access control for the AWS Access Portal, there are some alternative approaches you can consider:

1. Third-party Identity Providers (IdPs): Some external IdPs offer device-based access control. By integrating a third-party IdP with AWS Identity Center, you may be able to implement device-specific restrictions. However, the exact capabilities would depend on the specific IdP you choose.

2. Network-based restrictions: Although not device-specific, you can restrict access to the AWS Access Portal based on IP ranges. This could be used to limit access to devices connected to a specific network, such as a corporate VPN.

3. Client certificates: Some organizations use client certificates installed on approved devices to authenticate users. This method could be combined with a third-party IdP that supports certificate-based authentication.

4. Mobile Device Management (MDM): Implementing an MDM solution could allow you to control which devices can access corporate resources, including the AWS Access Portal.

5. Custom authentication flow: You could potentially create a custom authentication flow using Amazon Cognito or another service that checks device characteristics before allowing access to the AWS Access Portal.

It's important to note that these solutions may require additional configuration and potentially third-party services. They may also not completely prevent access from unauthorized devices but rather add an additional layer of security.

For the most robust solution, you might consider a combination of these approaches, such as using a third-party IdP with strong device management capabilities along with network-based restrictions.

Remember that implementing such restrictions may impact user experience and require additional management overhead. It's crucial to balance security requirements with usability and operational considerations.  
**Sources**  
[Can we enforce the use of hardware tokens only for some users in AWS IAM identity center users? | AWS re:Post](https://repost.aws/questions/QUz7RRAwPFTdKsCSa4avbn2Q/can-we-enforce-the-use-of-hardware-tokens-only-for-some-users-in-aws-iam-identity-center-users)  
[Restricting Access to AWS Identity Center to Specific IP Range | AWS re:Post](https://repost.aws/questions/QUtcW8p1guQ0mCIn6ZvLIXpw/restricting-access-to-aws-identity-center-to-specific-ip-range)

Can I allow AWS Access Portal access only from specific devices?

Add your answer

Relevant content