Appstream 2.0 Public IP ranges

Question

Hi,

Customer who has a large Amazon Appstream 2.0 fleet wants to optimize outbound proxy/firewall configuration for access from their corporate network. Is there is please a way to identify Appstream 2.0 IP public ranges in Amazon IP ranges?

I do not see any specific service for Appstream 2.0 in Amazon Public IP ranges [here][1].

Should the customer use "WORKSPACES_GATEWAYS" ? Or, how can they find the public IPs corresponding to streaming endpoints on Appstream 2.0?

Note: customer is aware they could also stream from an Interface VPC endpoint, but they also want to keep the internet access open for other use cases.

[1]: https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html#aws-ip-syntax

Accepted Answer

The public IP address ranges for AppStream come out of the public address space for EC2 and CloudFront predominately.

The best bet is for the customer to allowlist the traffic to the FQDN endpoints, defined here:

https://docs.aws.amazon.com/appstream2/latest/developerguide/allowed-domains.html

Keep in mind that the traffic is web based traffic on HTTPs, so the allowlisting would likely need to occur on their web proxies.

The workspaces_gateways in the JSON file are specific to the WorkSpaces service only (and not relevant to AppStream).

Hope that helps!

Appstream 2.0 Public IP ranges

Relevant content