Sold by: Zscaler, Inc.
Deployed on AWS
ZPA Connectors provide the secure authenticated interface between a customer's servers and the Zscaler Private Access cloud.
App Connectors can be deployed in several forms. Zscaler distributes a standard virtual machine (VM) image for deployment in enterprise data centers, local private cloud environments such as VMware, or public cloud environments such as Amazon Web Services (AWS) EC2. Additionally, Zscaler provides packages that can be installed on supported Linux distributions.
Connectors can be co-located with your enterprise applications, or they can be deployed in any location that has connectivity to the applications. Typically, they are deployed on network segments that can access secured applications and the ZPA cloud simultaneously, such as in a DMZ. Connectors only connect outbound; they do not need any inbound open ports to operate correctly.
4.4
Overview
The Zscaler Private Access (ZPA) service enables organizations to provide access to internal applications and services while ensuring the security of their networks. ZPA is an easier to deploy, more cost-effective, and more secure alternative to VPNs. Unlike VPNs, which require users to connect to your network to access your enterprise applications, ZPA allows you to give users policy-based secure access only to the internal apps they need to get their work done. With ZPA, application access does not require network access.
While ZPA is for connecting users to an enterprise's internal applications, Zscaler Internet Access (ZIA) is for connecting users to public applications on the internet. To learn more about ZIA architecture, see About the ZIA Cloud Architecture.
Additionally, ZPA decouples applications from the physical network so you can provide seamless connectivity to private internal applications and assets whether they are in the cloud, the data center, or both. It also adjusts dynamically to network changes, so you can move your resources without impacting user access.
You can configure settings and policies on a central ZPA Admin Portal, which also feature dashboards where you can see your users and the apps they access, and monitor the health of your servers and resources. You can configure ZPA to automatically discover servers and applications when users request them, or you can configure them manually as well. You then define policies that specify which apps users or groups can use, and ZPA allows them to connect to those apps only. ZPA renders your applications invisible to all but the authorized users and unroutable to anyone.
Like all Zscaler offerings the ZPA service is based on Zscaler's global cloud platform. So, there is no requirement for additional hardware or upgrades to existing hardware.
Highlights
- Zscaler Client Connector: Installed on your users' devices, the Zscaler Client Connector connects to the ZPA cloud to enable granular, policy-based access to your organization's internal resource.
- App Connectors: Lightweight virtual machines (VM) that are installed in the data centers that host your servers and applications. They connect to ZPA Public Service Edges or ZPA Private Service Edges only to provide users access to applications in your data center, and do not accept inbound connections.
- Global Zscaler Cloud: Stitches all components together. The Central Authority (CA) provides a central location for software updates as well as policy and configuration settings. The ZPA Public Service Edges or ZPA Private Service Edges enforce user policies and provides secure transport to the App Connectors.
Details
Sold by
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Rhel 9
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing and entitlements for this product are managed through an external billing relationship between you and the vendor. You activate the product by supplying a license purchased outside of AWS Marketplace, while AWS provides the infrastructure required to launch the product. AWS Subscriptions have no end date and may be canceled any time. However, the cancellation won't affect the status of the external license.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Vendor refund policy
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
For Release notes please access this link: https://help.zscaler.com/zpa/documentation-knowledgebase/release-notes/zpa-app-connector-release-notes
Additional details
Usage instructions
In order to acquire a license key for this product, please contact us via our web form here: https://www.zscaler.com/company/contact .
Once complete, you may access the User Interface of the Zscaler Cloud Portal by accessing this link here: https://admin.zscaler.net/ . If not completed prior, you will be promoted to create an Admin account for your Zscaler Cloud Portal.
Utilizing the login you created, you may now utilize the Zscaler Cloud Portal to access your Zscaler management console where you will be able to manage and deploy new products on AWS, or other locations.
For ZPA Connector AWS Deployment see the below:
Update the Security Group associated to the App Connector to temporarily allow inbound access on port 22, then complete the following steps to connect to the instance.
SSH access is required in order to configure the provisioning key for the App Connector. See instructions: https://help.zscaler.com/zpa/connector-deployment-guide-amazon-web-services#security
Log in to the App Connector console using your AWS Private Key (i.e., a .pem file).
SSH access is enabled by default on AWS App Connectors, so there is no need to enable the service manually.
Using a standard SSH client, enter the following command to connect to the AWS instance: ssh -i <AWS Private Key> admin@<App Connector Public Hostname or IP Address>
For example, the private key for the AWS instance is AWS.pem and the App Connector IP address is 35.160.130.25: ssh -i AWS.pem admin@35.160.130.25
Support
Vendor support
Zscaler global support is available around the clock, with dedicated customer support engineers providing personalized assistance to ensure that customers are getting the most value from our products. Our support engineers have significant experience in networking and security, working closely with operations, sales, and engineering teams to ensure rapid response and resolution.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Zscaler Private Access (ZPA) Network Connectors provide a secure authenticated interface between remote network segments and the ZPA cloud, and help enable end-to-end secure remote access. Network Connectors are part of the VPN (for Legacy Apps) solution and build the inside-out tunnel to VPN Service Edges and ZPA Public Brokers. You can deploy Network Connectors in two forms:
A standard virtual machine (VM) image for deployment in datacenter and campus remote sites.
AMI images for Amazon Web Services (AWS) EC2 and VM images for Microsoft Azure.
Additionally, Zscaler provides packages that you can install on RHEL (9.x) Linux distributions. Network Connectors allow seamless connectivity to specific network segments and can be deployed in any location that has connectivity to the ZPA cloud. Like App Connectors, Network Connectors connect outbound only and do not require inbound open ports for operation.
Zscaler Private Access (ZPA) applies the principles of least privilege to give users secure connectivity to private applications while eliminating unauthorized access and lateral movement. ZPA can be deployed in hours to replace legacy VPN and remote access tools with a holistic zero trust platform.
The ZPA Private Service Edges are brokers that are a single-tenant instance that provide the functionality of a ZPA Public Service Edge in an organization's environment. Your organization hosts them either within your site or on a cloud service, but Zscaler manages them. On the other hand, ZPA Public Service Edges are deployed in Zscaler data centers around the world.
As with a ZPA Public Service Edge, a ZPA Private Service Edge manages the connections between Zscaler Client Connector and App Connectors. It registers with the ZPA Cloud. This allows a ZPA Private Service Edge to download the relevant policies and configurations so it can enforce all ZPA policies. It also caches path selection decisions.
ZPA Private Service Edges can be deployed in several forms. Zscaler distributes images for deployment in enterprise data centers and local private cloud environments such as VMware.
Enabled by the Zscaler Zero Trust Exchange (ZTE), Zscaler Cloud Connector is a virtual machine (VM) that simplifies traffic forwarding to Zscaler services. It extends the capabilities of Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) to cloud-native workloads, which allows enterprises to secure cloud workload communications over any network.
The ZTE enables workloads to communicate with each other and have a granular security policy applied. The communication may be from private workloads (i.e., IaaS, physical data center) to public workloads (i.e., SaaS/internet), or between private workloads (i.e., IaaS to IaaS, IaaS to physical data center).
Customer reviews
Nabil L.
Zero Trust and performance with Zscaler Private Access
Reviewed on Oct 01, 2026
Review provided by G2
What do you like best about the product?
It is very useful when accessing private applications that are hosted on-premises. It replaces traditional VPNs and provides Zero Trust Network access with enhanced security.
What do you dislike about the product?
1. A little bit complex configuration setup. 2. Depends on service edge, and if the service edge is near, latency is good, but if the service edge is far, there will be latency issues.
What problems is the product solving and how is that benefiting you?
It is solving the access part and performance part. By using this, performance will improve by 50% compared to using traditional VPNs. Access policy using MFA is best.
Thanh Phu N.
High Latency Through Zscaler Tunnel Needs Improvement
Reviewed on Sep 30, 2026
Review provided by G2
What do you like best about the product?
I can see it will be helpful with the enterprise. It can supply the security access when using Zscaler and you can be protected with the tunnel. I can see that
What do you dislike about the product?
Some destination host or services show that high latency when the traffic from client go through via Zscaler tunnel. Additionally, I also see some services like DNS can be encrypted
What problems is the product solving and how is that benefiting you?
Zscaler Private Access (ZPA) solves critical security and operational challenges associated with legacy Virtual Private Networks (VPNs). Problems Solved: Broad Network Exposure: Traditional VPNs grant users full access to the network, increasing the risk of lateral threat movement. ZPA enforces Zero Trust Network Access (ZTNA), connecting authorized users directly to specific private applications rather than the entire corporate network. Exposed Attack Surfaces: ZPA makes internal applications invisible to unauthorized users and the public internet, preventing inbound attacks. High Latency and Complexity: It eliminates backhauling traffic through legacy VPN concentrators, reducing congestion and hardware management overhead. Key Benefits: Enhanced Security: You get least-privilege, identity-based access, significantly lowering the risk of data breaches. Seamless User Experience: Enjoy fast, low-latency connectivity to hybrid cloud and on-premises apps automatically. Operational Efficiency: IT teams save management time, cut infrastructure costs, and safely support remote or third-party users without complex configurations.
Ajay G.
Keeps Private Apps Invisible to the Internet with a “Dark Cloud” Approach
Reviewed on Sep 30, 2026
Review provided by G2
What do you like best about the product?
Your private applications stay invisible to the internet. Because there are no inbound listening ports, internal apps remain hidden behind a “dark cloud.” As a result, scanners like Shodan—or potential attackers—can’t easily probe your network perimeter for exposed IP addresses, unpatched VPN concentrator vulnerabilities, or open ports.
What do you dislike about the product?
The challenge: Moving from a broad, subnet-level VPN to more granular ZTNA means you have to map every enterprise application in detail, including the relevant IP ranges, ports, and domains.
Impact: In legacy environments with hundreds of unstructured applications, that discovery and documentation work can be tedious and time-consuming. And if an application segment or wildcard rule is misconfigured, end-user access can break immediately.
Impact: In legacy environments with hundreds of unstructured applications, that discovery and documentation work can be tedious and time-consuming. And if an application segment or wildcard rule is misconfigured, end-user access can break immediately.
What problems is the product solving and how is that benefiting you?
Broad Network Exposure (Layer 3 Access)
The problem: Traditional VPNs place user devices directly onto the corporate network. If a remote endpoint or a user account is compromised, an attacker can scan subnets and move laterally across critical servers.
The solution: ZPA enforces true micro-segmentation with Layer 7 access. Instead of exposing the broader network, users connect only to the specific applications they’re authorized to use, while everything else remains completely hidden.
The problem: Traditional VPNs place user devices directly onto the corporate network. If a remote endpoint or a user account is compromised, an attacker can scan subnets and move laterally across critical servers.
The solution: ZPA enforces true micro-segmentation with Layer 7 access. Instead of exposing the broader network, users connect only to the specific applications they’re authorized to use, while everything else remains completely hidden.
Computer & Network Security
Quick, Helpful Support and an Easy-to-Navigate GUI
Reviewed on Sep 28, 2026
Review provided by G2
What do you like best about the product?
The best thing that I have liked so far is the support help in cases where we get stuck. They provide very quick resolution and follow up with all the requests that we raise. Plus GUI is really easy to use and navigate with things mentioned very clearly
What do you dislike about the product?
There isn’t much to dislike overall, but one major issue for me is that it doesn’t allow us to open the same page in multiple tabs, which makes it harder to check policies and administration at the same time.
What problems is the product solving and how is that benefiting you?
We are currently working through issues related to better management of VPN access. Since Zscaler is cloud-based, it provides improved access and greater scalability.
Health, Wellness and Fitness
Secure Web Access Made Easy, But Needs More Flexible Filtering Controls
Reviewed on Sep 28, 2026
Review provided by G2
What do you like best about the product?
It’s easy to restrict users’ access to my web servers. Zscaler has been used in all of my previous organizations, including my current one, to establish a secure connection to our internal websites.
What do you dislike about the product?
Customizing more filters would help. At times I have to manually turn off Zscaler to access required sites, which is a pain. I wish it were easier to customize settings for specific teams, rather than having changes apply across the entire organization.
What problems is the product solving and how is that benefiting you?
As I mentioned earlier, being able to restrict access to my web servers so they can only be reached from certain IPs is a big plus. It has helped ensure that no unauthorised access is getting through to my servers.