AWS workspaces documentation change
Summary
Added Europe (Paris) region domains, IP ranges, and a new 'Domains and IP Addresses to add to your allowlist' section with security-related endpoints including CAPTCHA, client auto-update URLs, and connectivity checks
Security assessment
The changes primarily expand documentation for the Europe (Paris) region and explicitly list domains/IPs required for security features like CAPTCHA, client auto-updates, and connectivity checks. While these updates help users configure secure allowlists, there is no evidence they address a specific disclosed vulnerability or security incident.
Diff
diff --git a/workspaces/latest/adminguide/workspaces-port-requirements.md b/workspaces/latest/adminguide/workspaces-port-requirements.md index e46437d6f..9f315b838 100644 --- a//workspaces/latest/adminguide/workspaces-port-requirements.md +++ b//workspaces/latest/adminguide/workspaces-port-requirements.md @@ -130,0 +131 @@ Client Metrics (for 3.0+ WorkSpaces client applications) | Domains (IPv4): + * https://skylight-client-ds.eu-west-3.amazonaws.com @@ -174,0 +176 @@ Dynamic Messaging Service (for 3.0+ WorkSpaces client applications) | Domains ( + * https://ws-client-service.eu-west-3.amazonaws.com @@ -226,0 +229 @@ Login page graphics for customer directory level co-branding: + * Europe (Paris) — https://d2kmf63k5sit88.cloudfront.net/ @@ -248,0 +252 @@ JavaScript file for the login pages: + * Europe (Paris) — https://d1a3pnge9on3sx.cloudfront.net/ @@ -295,0 +300 @@ WS Broker | Domains (IPv4): + * https://ws-broker-service.eu-west-3.amazonaws.com @@ -305,0 +311 @@ Domains (IPv6): + * https://ws-broker-service.eu-west-3.api.aws @@ -342,0 +349 @@ WorkSpaces API Endpoints | Domains (IPv4): + * https://workspaces.eu-west-3.amazonaws.com @@ -352,0 +360 @@ Domains (IPv6): + * https://workspaces.eu-west-3.api.aws @@ -415,0 +424 @@ Session Broker (PCM) | Domains (IPv4): + * https://skylight-cm.eu-west-3.amazonaws.com @@ -427,0 +437 @@ Domains (IPv6): + * https://skylight-cm.eu-west-3.api.aws @@ -488,0 +499 @@ Europe (London) | drp-lhr.amazonworkspaces.com | 35.176.62.54 35.177.255.44 52. +Europe (Paris) | drp-cdg.amazonworkspaces.com | 51.17.52.90 51.17.109.231 51.16.190.43 @@ -511,0 +523 @@ Europe (London) | eu-west-2 | 18.132.21.0 - 18.132.21.255 18.132.22.0 - 18.132. +Europe (Paris) | eu-west-3 | 51.44.204.0-51.44.207.255 @@ -702,0 +715 @@ Europe (London) | *.prod.eu-west-2.highlander.aws.a2z.com +Europe (Paris) | *.prod.eu-west-3.highlander.aws.a2z.com @@ -763,0 +777 @@ Europe (London) | PCoIP/WSP: 198.19.0.0/16 WSP: 10.0.0.0/8 +Europe (Paris) | PCoIP/WSP: 198.19.0.0/16 WSP: 10.0.0.0/8 @@ -1749,0 +1764,79 @@ Management interface IP address ranges | +Domains and IP Addresses to add to your allowlist Category | Details +---|--- +CAPTCHA | https://opfcaptcha-prod.s3.amazonaws.com/Client +Client Auto-update | https://d2td7dqidlhjx7.cloudfront.net/ +Connectivity Check | https://connectivity.amazonworkspaces.com/ +Client Metrics (for 3.0+ WorkSpaces client applications) | Domain: https://skylight-client-ds.eu-west-3.amazonaws.com +Dynamic Messaging Service (for 3.0+ WorkSpaces client applications) | Domain: https://ws-client-service.eu-west-3.amazonaws.com +Directory Settings | Authentication from the client to the customer directory before login to the WorkSpace: + + * https://d32i4gd7pg4909.cloudfront.net/prod/<region>/<directory ID> + +Connections from macOS clients: + + * https://d32i4gd7pg4909.cloudfront.net/ + +Customer directory settings: + + * https://d21ui22avrxoh6.cloudfront.net/prod/<region>/<directory ID> + +Login page graphics for customer directory level co-branding: + + * https://d2kmf63k5sit88.cloudfront.net/prod/<region>/<directory ID> + +CSS file to style the login pages: + + * https://d3s98kk2h6f4oh.cloudfront.net/ + * https://dyqsoz7pkju4e.cloudfront.net/ + +JavaScript file for the login pages: + + * Europe (Paris) — https://d1a3pnge9on3sx.cloudfront.net/ + + +Forrester Log Service | https://fls-na.amazon.com/ +Health Check (DRP) Servers | Health check servers +Registration Dependency (for Web Access and Teradici PCoIP Zero Clients) | https://s3.amazonaws.com +User Login Pages | https://<directory id>.awsapps.com/ (where <directory id> is the customer's domain) +WS Broker | Domain: + + * https://ws-broker-service.eu-west-3.amazonaws.com + + +WorkSpaces API Endpoints | Domain: + + * https://workspaces.eu-west-3.amazonaws.com + + +Session Broker (PCM) | Domain: + + * https://skylight-cm.eu-west-3.amazonaws.com + + +Web Access TURN Servers for PCoIP | Server: + + * turn:*.eu-west-3.rdn.amazonaws.com + + +Health check hostname | drp-cdg.amazonworkspaces.com +Health check IP addresses | + + * 51.17.52.90 + * 51.17.109.231 + * 51.16.190.43 + + +PCoIP gateway servers public IP address ranges | + + * 51.44.204.0-51.44.207.255 2a05:d032:2000::/40 + + +DCV gateway servers IP address range | 51.17.72.0/22 +DCV gateway domain name | *.prod.eu-west-3.highlander.aws.a2z.com +Management interface IP address ranges | + + * 198.19.0.0/16 + * WSP: 10.0.0.0/8 + + +