How to create ACLs for access to AWS workspaces (EDLs don't cover all IPs)

Commander_JB — Tue, 31 Dec 2024 19:44:48 GMT

I need to create ACLs for outbound access to AWS workspaces using the destination IPs / subnets / FQDNs shown on AWS publication https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-port-requirements.html#ip-address-regions.

PAN publishes an EDL for AWS workspace, but it only contains a handful of IPs. Some of the IPs listed in the above URL is not found even in the AWS US ALL IP EDL.

I suppose the next best thing is to create ACL using static IPs and FQDNs, but some of the FQDNs are wildcards. How would you create rules with these as destinations?

https://<directory id>.awsapps.com/ (where <directory id> is the customer's domain)

turn:*.us-west-2.rdn.amazonaws.com

*.prod.us-west-2.highlander.aws.a2z.com

Re: How to create ACLs for access to AWS workspaces (EDLs don't cover all IPs)

JayGolf — Thu, 02 Jan 2025 23:10:57 GMT

Hi @Commander_JB ,

For the wildcards, I would test out creating a separate policy that enforces a custom url category that includes all the wildcard domains you need for workspaces. Here is a KB on examples of using wildcards.

topic How to create ACLs for access to AWS workspaces (EDLs don't cover all IPs) in General Topics

How to create ACLs for access to AWS workspaces (EDLs don't cover all IPs)

Re: How to create ACLs for access to AWS workspaces (EDLs don't cover all IPs)