AWS appstream2 documentation change
Summary
Added new sections for Streaming Instances, User Authentication, and AWS IP address ranges. The User Authentication section provides detailed SAML 2.0 SSO endpoints including AWS Sign-in endpoints and WorkSpaces Applications relay state endpoints for various regions.
Security assessment
This change adds documentation about required network endpoints for SAML 2.0 authentication, which is a security feature. It helps administrators properly configure network access for secure authentication flows, but there's no evidence of addressing a specific security vulnerability or incident.
Diff
diff --git a/appstream2/latest/developerguide/allowed-domains.md b/appstream2/latest/developerguide/allowed-domains.md index ce1c58c4e..bd221e619 100644 --- a//appstream2/latest/developerguide/allowed-domains.md +++ b//appstream2/latest/developerguide/allowed-domains.md @@ -6,0 +7,2 @@ +Streaming InstancesUser AuthenticationAWS IP address ranges + @@ -8,0 +11,2 @@ +## Streaming Instances + @@ -63,0 +68,2 @@ South America (São Paulo) | *.streaming.appstream2.sa-east-1.on.aws *.dcv-stre +## User Authentication + @@ -92,0 +99,77 @@ If your users use a network proxy to access streaming instances, disable any pro +For SAML 2.0 [single sign-on (SSO)] authentication, you must allow these three additional endpoints: + + 1. AWS Sign-in endpoint + + 2. AWS Sign-in region endpoints where WorkSpaces Applications is available + + 3. WorkSpaces Applications relay state region endpoints + + + + +The following table lists the AWS Sign-in endpoint. + +AWS Sign-in endpoint +--- +`signin.aws.amazon.com` + +The following table lists the AWS Sign-in region endpoints for the Regions where WorkSpaces Applications is available. + +AWS Sign-in region endpoints Region | Domain +---|--- +US East (N. Virginia) | `us-east-1.signin.aws.amazon.com` +US East (Ohio) | `us-east-2.signin.aws.amazon.com` +US West (Oregon) | `us-west-2.signin.aws.amazon.com` +Asia Pacific (Malaysia) | `ap-southeast-5.signin.aws.amazon.com` +Asia Pacific (Mumbai) | `ap-south-1.signin.aws.amazon.com` +Asia Pacific (Seoul) | `ap-northeast-2.signin.aws.amazon.com` +Asia Pacific (Singapore) | `ap-southeast-1.signin.aws.amazon.com` +Asia Pacific (Sydney) | `ap-southeast-2.signin.aws.amazon.com` +Asia Pacific (Tokyo) | `ap-northeast-1.signin.aws.amazon.com` +Canada (Central) | `ca-central-1.signin.aws.amazon.com` +Europe (Frankfurt) | `eu-central-1.signin.aws.amazon.com` +Europe (Ireland) | `eu-west-1.signin.aws.amazon.com` +Europe (London) | `eu-west-2.signin.aws.amazon.com` +Europe (Milan) | `eu-south-1.signin.aws.amazon.com` +Europe (Paris) | `eu-west-3.signin.aws.amazon.com` +Europe (Spain) | `eu-south-2.signin.aws.amazon.com` +AWS GovCloud (US-East) | `us-gov-east-1.signin.amazonaws-us-gov.com` +AWS GovCloud (US-West) | `signin.amazonaws-us-gov.com` +South America (São Paulo) | `sa-east-1.signin.aws.amazon.com` +Israel (Tel Aviv) | `il-central-1.signin.aws.amazon.com` + +The following table lists the WorkSpaces Applications relay state region endpoints. + +WorkSpaces Applications relay state region endpoints Region | Domain +---|--- +US East (N. Virginia) | `appstream2.euc-sso.us-east-1.aws.amazon.com` (FIPS) `appstream2.euc-sso-fips.us-east-1.aws.amazon.com` +US East (Ohio) | `appstream2.euc-sso.us-east-2.aws.amazon.com` +US West (Oregon) | `appstream2.euc-sso.us-west-2.aws.amazon.com` (FIPS) `appstream2.euc-sso-fips.us-west-2.aws.amazon.com` +Asia Pacific (Malaysia) | `appstream2.euc-sso.ap-southeast-5.aws.amazon.com` +Asia Pacific (Mumbai) | `appstream2.euc-sso.ap-south-1.aws.amazon.com` +Asia Pacific (Seoul) | `appstream2.euc-sso.ap-northeast-2.aws.amazon.com` +Asia Pacific (Singapore) | `appstream2.euc-sso.ap-southeast-1.aws.amazon.com` +Asia Pacific (Sydney) | `appstream2.euc-sso.ap-southeast-2.aws.amazon.com` +Asia Pacific (Tokyo) | `appstream2.euc-sso.ap-northeast-1.aws.amazon.com` +Canada (Central) | `appstream2.euc-sso.ca-central-1.aws.amazon.com` +Europe (Frankfurt) | `appstream2.euc-sso.eu-central-1.aws.amazon.com` +Europe (Ireland) | `appstream2.euc-sso.eu-west-1.aws.amazon.com` +Europe (London) | `appstream2.euc-sso.eu-west-2.aws.amazon.com` +Europe (Milan) | `appstream2.euc-sso.eu-south-1.aws.amazon.com` +Europe (Paris) | `appstream2.euc-sso.eu-west-3.aws.amazon.com` +Europe (Spain) | `appstream2.euc-sso.eu-south-2.aws.amazon.com` +AWS GovCloud (US-East) | `appstream2.euc-sso.us-gov-east-1.amazonaws-us-gov.com` (FIPS) `appstream2.euc-sso-fips.us-gov-east-1.amazonaws-us-gov.com` + +###### Note + +For more information about using WorkSpaces Applications in AWS GovCloud (US) Regions, see [Amazon WorkSpaces Applications](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-appstream2.html) in the _AWS GovCloud (US) User Guide_. +AWS GovCloud (US-West) | `appstream2.euc-sso.us-gov-west-1.amazonaws-us-gov.com` (FIPS) `appstream2.euc-sso-fips.us-gov-west-1.amazonaws-us-gov.com` + +###### Note + +For more information about using WorkSpaces Applications in AWS GovCloud (US) Regions, see [Amazon WorkSpaces Applications](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-appstream2.html) in the _AWS GovCloud (US) User Guide_. +South America (São Paulo) | `appstream2.euc-sso.sa-east-1.aws.amazon.com` +Israel (Tel Aviv) | `appstream2.euc-sso.il-central-1.aws.amazon.com` + +## AWS IP address ranges +