How do I allow AWS Access Portal access only from vpn or specific devices?

Question

Hi all

I could see some customers allow AWS Portal Access only for their users who signed on their VPN. How did they do that?

I saw a post - https://repost.aws/questions/QUwEJUlZ1ZSkijpxkfHWtV0g/aws-access-portal-url-sso-login-url-restricting-access-to-vpn, but this is not what I wanted. I don't want to show even the AWS Portal if the user is not on the VPN.

Or is there any way to restrict devices that can have access to the portal or console?

Thanks.

Riku_Kobayashi · Accepted Answer

Hello.

I have given a similar answer in the URL below, but if you authenticate using an external IdP, it may be possible to implement IP restrictions using the IdP's functions.  
https://repost.aws/ja/questions/QUtPJM5O82SGiS652R3MSltg/can-i-allow-aws-access-portal-access-only-from-specific-devices

For example, Azure Entra ID has an IP restriction function, so it is probably possible to restrict by IP address.  
https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview

re:Post Agent · Answer

To restrict AWS Access Portal access to only users connected through a VPN, you can implement a combination of network and security controls. Here's how you can achieve this:

1. Configure your VPN solution to assign a specific IP range or CIDR block to connected clients.

2. Use a web content filtering solution such as next-generation firewalls (NGFW) or Secure Web Gateways (SWG) to control access to the AWS Access Portal domains and URL endpoints.

3. Configure your firewall or web gateway to only allow traffic to the AWS Access Portal domains from the IP range assigned by your VPN.

4. Add the necessary AWS Access Portal domains and URL endpoints to your allowlist in the web content filtering solution. These include domains like:
   - [Your Directory ID or alias].awsapps.com
   - *.aws.dev
   - *.awsstatic.com
   - *.console.aws.a2z.com
   - *.sso.amazonaws.com
   - *.sso.[Region].amazonaws.com
   - [Region].signin.aws
   - signin.aws.amazon.com

5. Ensure that access to these domains is restricted to only the IP range assigned by your VPN.

By implementing these controls, users will only be able to access the AWS Access Portal when connected to your VPN. If they attempt to access it from outside the VPN, the firewall or web gateway will block the connection, effectively preventing even the portal from being displayed.

Remember to also configure your VPN solution to enforce its use for accessing corporate resources, ensuring users cannot bypass it to reach the AWS Access Portal.  
**Sources**  
[Update firewalls and gateways to allow access to the AWS access portal - AWS IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/enable-identity-center-portal-access.html)

How do I allow AWS Access Portal access only from vpn or specific devices?

Add your answer

Relevant content