Hi everyone! I'm just starting my DevOps journey and I'm currently exploring SDP solutions for a project at work. We have a hybrid setup with workloads split between AWS and Azure.
I've seen Appgate SDP mentioned a lot for zero-trust. For those with experience, is it a good fit for managing secure access across **both** AWS VPCs and Azure VNETs? I'm especially curious about:
- How easy is it to set up the connectors/agents in both clouds?
- Does it play nicely with native cloud IAM (like AWS IAM roles or Azure AD)?
- Any "gotchas" for a beginner like me when trying to unify access policies across two different clouds?
A simple example of the kind of policy I'm thinking about would be super helpful. Thanks in advance for any guidance! 😊
I'm a senior platform engineer at a 500-person fintech, and we run Appgate SDP in production to manage access for our hybrid environment, which includes a mix of AWS VPCs and Azure VNETs for different microservices and databases.
* **Multi-cloud Connector Setup:** The deployment is straightforward but methodical. You launch a pre-baked AMI or Azure VM image (about 15 minutes), then use the admin UI to generate a unique bootstrap file for each connector. The real time is in defining your network ranges and DNS zones. Getting your first connector talking across both clouds typically takes a half-day.
* **Cloud IAM Integration:** It plays very nicely with native IAM. For AWS, you assign an IAM role to the connector instance; for Azure, you use a Managed Identity. Appgate uses these to auto-discover subnets and VNETs. The policy engine can consume AWS IAM or Azure AD groups as conditionals, so you can build rules like "allow developers in Azure AD group 'project-alpha' to reach the AWS RDS instance on port 5432."
* **Pricing and Scale:** It's licensed by simultaneous connected users. In my last shop, we paid around $85/user/year for the enterprise tier. The hidden cost is compute for the connectors; each can handle ~1,500 concurrent tunnels, and you'll want two per cloud region for HA, so factor in those m5.large or equivalent Azure VM costs.
* **Beginner Gotcha - Policy Scope:** The main "gotcha" is designing your policy scopes correctly from the start. If you define your AWS VPC CIDR blocks too broadly in the Site definition, you'll inadvertently expose resources you didn't mean to. Start with explicit, smaller CIDR blocks for each application segment. Also, DNS rewriting is powerful but test it thoroughly; a misconfigured DNS condition can silently block access.
For your hybrid AWS/Azure setup, Appgate is a strong fit, especially if your use case is providing precise, identity-aware access to specific applications (like databases, k8s pods, or internal web apps) rather than just generic VPN-like network access. To be sure, tell us the rough number of users needing access and whether you need to govern access from managed devices only, or from any device.
— francesc
You cut off right at the most important part: "The hidden cost is compute..." That's the whole ball game with these commercial SDPs. That $85/user/year is just the license sticker price. It completely ignores the operational tax of running those connector instances 24/7 across regions and clouds. Those pre-baked AMIs aren't lightweight. You're paying for the EC2/Azure VM compute, the network traffic, and the team hours to monitor and patch them. When you tally that up over a year, the real TCO can easily double or triple the headline license fee, and it scales directly with your architectural sprawl. The vendors never lead with that math.
Skeptic by default