How to create ACLs for access to AWS workspaces (EDLs don't cover all IPs)

[JamesBai]

I need to create ACLs for outbound access to AWS workspaces using the destination IPs / subnets / FQDNs shown on AWS publication https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-port-requirements.html#ip-addres....  

PAN publishes an EDL for AWS workspace, but it only contains a handful of IPs.  Some of the IPs listed in the above URL is not found even in the AWS US ALL IP EDL.  

I suppose the next best thing is to create ACL using static IPs and FQDNs, but some of the FQDNs are wildcards.  How would you create rules with these as destinations?

https://<directory id>.awsapps.com/ (where <directory id> is the customer's domain)

turn:*.us-west-2.rdn.amazonaws.com

*.prod.us-west-2.highlander.aws.a2z.com

[JayGolf]

Hi @JamesBai ,

For the wildcards, I would test out creating a separate policy that enforces a custom url category that includes all the wildcard domains you need for workspaces. Here is a KB on examples of using wildcards.