Switch Role on Windows10 Fails with AWS Source IPAssigning name to IAM Role with cloudformationHow can I create a role with specified name in AWS CloudFormationAWS IAM role for use within a classroomHow to know if an AWS IAM role is actually being usedHow to use a AWS EC2 Iam role with AnsibleCreating IAM role fails with AdministratorAccessAWS access token for user assuming roleHow to “switch role” in aws-cli?SSM Managed instance using AWS CLI and assume-roleHow to limit the permissions AWS IAM RoleA can grant to a role (Role B) it creates
Alphabet completion rate
How can I deal with a coworker killed on the job
Impossible darts scores
Is there any set of 2-6 notes that doesn't have a chord name?
Require advice on power conservation for backpacking trip
Does squid ink pasta bleed?
How to get cool night-vision without lame drawbacks?
How can I convince my reader that I will not use a certain trope?
Why is there no havdallah when going from Yom Tov into Shabbat?
In the Marvel universe, can a human have a baby with any non-human?
Should my manager be aware of private LinkedIn approaches I receive? How to politely have this happen?
Peace Arch without exiting USA
How come I was asked by a CBP officer why I was in the US?
Is it damaging to turn off a small fridge for two days every week?
90s (or earlier) cross-world fantasy book with a circular river and character-class tattoos
Distance Matrix (plugin) - QGIS
Should I tell my insurance company I'm making payments on my new car?
Do equal angles necessarily mean a polygon is regular?
Abel-Jacobi map on symmetric product of genus 4 curve
Why do textbooks often include the solutions to odd or even numbered problems but not both?
When is the original BFGS algorithm still better than the Limited-Memory version?
STM Microcontroller burns every time
Why is the Turkish president's surname spelt in Russian as Эрдоган, with г?
Why do some professors with PhDs leave their professorships to teach high school?
Switch Role on Windows10 Fails with AWS Source IP
Assigning name to IAM Role with cloudformationHow can I create a role with specified name in AWS CloudFormationAWS IAM role for use within a classroomHow to know if an AWS IAM role is actually being usedHow to use a AWS EC2 Iam role with AnsibleCreating IAM role fails with AdministratorAccessAWS access token for user assuming roleHow to “switch role” in aws-cli?SSM Managed instance using AWS CLI and assume-roleHow to limit the permissions AWS IAM RoleA can grant to a role (Role B) it creates
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
When a user on Windows 10 tries to switch roles in AWS it fails with
Failed authentication
We have a Condition in our sts:AssumeRole policy to only allow the role to switch if the user is coming from a white-listed IP address. Those addresses correspond to our NAT IP's. The user googles "what's my IP" and it returns the NAT IP we expect to see.
What's peculiar is the IP address in the CloudTrail logs is not our NAT IP. It is owned by AWS.
We have tried this in Chrome and Firefox with the same result. What I expect to happen is the user switches roles without an issue.
This issue does not occur when using Windows7 or MacOS.
Thoughts?
amazon-web-services windows-10 amazon-iam
asked Jun 7 at 20:22
kenlukaskenlukas
5373 silver badges13 bronze badges
add a comment |
When a user on Windows 10 tries to switch roles in AWS it fails with
Failed authentication
We have a Condition in our sts:AssumeRole policy to only allow the role to switch if the user is coming from a white-listed IP address. Those addresses correspond to our NAT IP's. The user googles "what's my IP" and it returns the NAT IP we expect to see.
What's peculiar is the IP address in the CloudTrail logs is not our NAT IP. It is owned by AWS.
We have tried this in Chrome and Firefox with the same result. What I expect to happen is the user switches roles without an issue.
This issue does not occur when using Windows7 or MacOS.
Thoughts?
amazon-web-services windows-10 amazon-iam
asked Jun 7 at 20:22
kenlukaskenlukas
5373 silver badges13 bronze badges
The Windows 7 and Mac behavior is what strikes me as unexpected. The console backend should be doing the legwork here rather than the browser, because the browser doesn't have the necessary credentials to make the call to STS... so I would have assumed that an AWS source IP would be expected, as a result.
– Michael - sqlbot
Jun 8 at 1:43
add a comment |
When a user on Windows 10 tries to switch roles in AWS it fails with
Failed authentication
We have a Condition in our sts:AssumeRole policy to only allow the role to switch if the user is coming from a white-listed IP address. Those addresses correspond to our NAT IP's. The user googles "what's my IP" and it returns the NAT IP we expect to see.
What's peculiar is the IP address in the CloudTrail logs is not our NAT IP. It is owned by AWS.
We have tried this in Chrome and Firefox with the same result. What I expect to happen is the user switches roles without an issue.
This issue does not occur when using Windows7 or MacOS.
Thoughts?
amazon-web-services windows-10 amazon-iam
asked Jun 7 at 20:22
kenlukaskenlukas
5373 silver badges13 bronze badges
When a user on Windows 10 tries to switch roles in AWS it fails with
Failed authentication
We have a Condition in our sts:AssumeRole policy to only allow the role to switch if the user is coming from a white-listed IP address. Those addresses correspond to our NAT IP's. The user googles "what's my IP" and it returns the NAT IP we expect to see.
What's peculiar is the IP address in the CloudTrail logs is not our NAT IP. It is owned by AWS.
We have tried this in Chrome and Firefox with the same result. What I expect to happen is the user switches roles without an issue.
This issue does not occur when using Windows7 or MacOS.
Thoughts?
amazon-web-services windows-10 amazon-iam
amazon-web-services windows-10 amazon-iam
asked Jun 7 at 20:22
kenlukaskenlukas
5373 silver badges13 bronze badges
asked Jun 7 at 20:22
kenlukaskenlukas
5373 silver badges13 bronze badges
asked Jun 7 at 20:22
kenlukaskenlukas
5373 silver badges13 bronze badges
asked Jun 7 at 20:22
kenlukaskenlukas
5373 silver badges13 bronze badges
asked Jun 7 at 20:22
kenlukaskenlukas
5373 silver badges13 bronze badges
5373 silver badges13 bronze badges
The Windows 7 and Mac behavior is what strikes me as unexpected. The console backend should be doing the legwork here rather than the browser, because the browser doesn't have the necessary credentials to make the call to STS... so I would have assumed that an AWS source IP would be expected, as a result.
– Michael - sqlbot
Jun 8 at 1:43
add a comment |
The Windows 7 and Mac behavior is what strikes me as unexpected. The console backend should be doing the legwork here rather than the browser, because the browser doesn't have the necessary credentials to make the call to STS... so I would have assumed that an AWS source IP would be expected, as a result.
– Michael - sqlbot
Jun 8 at 1:43
The Windows 7 and Mac behavior is what strikes me as unexpected. The console backend should be doing the legwork here rather than the browser, because the browser doesn't have the necessary credentials to make the call to STS... so I would have assumed that an AWS source IP would be expected, as a result.
– Michael - sqlbot
Jun 8 at 1:43
The Windows 7 and Mac behavior is what strikes me as unexpected. The console backend should be doing the legwork here rather than the browser, because the browser doesn't have the necessary credentials to make the call to STS... so I would have assumed that an AWS source IP would be expected, as a result.
– Michael - sqlbot
Jun 8 at 1:43
add a comment |
1 Answer
1
active
oldest
votes
That address 76.223.160.183 is not AWS address. It doesn't show up in any advertised AWS range in any region. Verified with filter-ip-ranges.
Although the IP block is owned by by Amazon the relevant 76.223.160.0/21 was delegated to Netskope Inc, check your whois output again. From the Wikipedia article about Netskope:
Netskope [...] helps companies protect data and protect against threats in cloud applications, cloud infrastructure, and the web. [...] The solution steers cloud and Web traffic to a cloud-native service for the purposes of inspection and policy enforcement.
So my conclusion is that the Windows 10 laptop has some sort of Netskope service or plugin installed that redirects some traffic to Netskope servers for inspection. From there it's forwarded to AWS but as it comes from Netskope IP range it fails your IAM Condition.
BTW Why it doesn't interfere with "what's my IP" I'm not sure, probably some whitelist in the plugin.
Hope that helps :)
answered Jun 8 at 3:06
MLuMLu
10.6k2 gold badges25 silver badges46 bronze badges
Thanks @Mlu, this is spot on. Thanks for the help
– kenlukas
Jun 10 at 18:41
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f970613%2fswitch-role-on-windows10-fails-with-aws-source-ip%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
That address 76.223.160.183 is not AWS address. It doesn't show up in any advertised AWS range in any region. Verified with filter-ip-ranges.
Although the IP block is owned by by Amazon the relevant 76.223.160.0/21 was delegated to Netskope Inc, check your whois output again. From the Wikipedia article about Netskope:
Netskope [...] helps companies protect data and protect against threats in cloud applications, cloud infrastructure, and the web. [...] The solution steers cloud and Web traffic to a cloud-native service for the purposes of inspection and policy enforcement.
So my conclusion is that the Windows 10 laptop has some sort of Netskope service or plugin installed that redirects some traffic to Netskope servers for inspection. From there it's forwarded to AWS but as it comes from Netskope IP range it fails your IAM Condition.
BTW Why it doesn't interfere with "what's my IP" I'm not sure, probably some whitelist in the plugin.
Hope that helps :)
answered Jun 8 at 3:06
MLuMLu
10.6k2 gold badges25 silver badges46 bronze badges
Thanks @Mlu, this is spot on. Thanks for the help
– kenlukas
Jun 10 at 18:41
add a comment |
That address 76.223.160.183 is not AWS address. It doesn't show up in any advertised AWS range in any region. Verified with filter-ip-ranges.
Although the IP block is owned by by Amazon the relevant 76.223.160.0/21 was delegated to Netskope Inc, check your whois output again. From the Wikipedia article about Netskope:
Netskope [...] helps companies protect data and protect against threats in cloud applications, cloud infrastructure, and the web. [...] The solution steers cloud and Web traffic to a cloud-native service for the purposes of inspection and policy enforcement.
So my conclusion is that the Windows 10 laptop has some sort of Netskope service or plugin installed that redirects some traffic to Netskope servers for inspection. From there it's forwarded to AWS but as it comes from Netskope IP range it fails your IAM Condition.
BTW Why it doesn't interfere with "what's my IP" I'm not sure, probably some whitelist in the plugin.
Hope that helps :)
answered Jun 8 at 3:06
MLuMLu
10.6k2 gold badges25 silver badges46 bronze badges
Thanks @Mlu, this is spot on. Thanks for the help
– kenlukas
Jun 10 at 18:41
add a comment |
That address 76.223.160.183 is not AWS address. It doesn't show up in any advertised AWS range in any region. Verified with filter-ip-ranges.
Although the IP block is owned by by Amazon the relevant 76.223.160.0/21 was delegated to Netskope Inc, check your whois output again. From the Wikipedia article about Netskope:
Netskope [...] helps companies protect data and protect against threats in cloud applications, cloud infrastructure, and the web. [...] The solution steers cloud and Web traffic to a cloud-native service for the purposes of inspection and policy enforcement.
So my conclusion is that the Windows 10 laptop has some sort of Netskope service or plugin installed that redirects some traffic to Netskope servers for inspection. From there it's forwarded to AWS but as it comes from Netskope IP range it fails your IAM Condition.
BTW Why it doesn't interfere with "what's my IP" I'm not sure, probably some whitelist in the plugin.
Hope that helps :)
answered Jun 8 at 3:06
MLuMLu
10.6k2 gold badges25 silver badges46 bronze badges
That address 76.223.160.183 is not AWS address. It doesn't show up in any advertised AWS range in any region. Verified with filter-ip-ranges.
Although the IP block is owned by by Amazon the relevant 76.223.160.0/21 was delegated to Netskope Inc, check your whois output again. From the Wikipedia article about Netskope:
Netskope [...] helps companies protect data and protect against threats in cloud applications, cloud infrastructure, and the web. [...] The solution steers cloud and Web traffic to a cloud-native service for the purposes of inspection and policy enforcement.
So my conclusion is that the Windows 10 laptop has some sort of Netskope service or plugin installed that redirects some traffic to Netskope servers for inspection. From there it's forwarded to AWS but as it comes from Netskope IP range it fails your IAM Condition.
BTW Why it doesn't interfere with "what's my IP" I'm not sure, probably some whitelist in the plugin.
Hope that helps :)
answered Jun 8 at 3:06
MLuMLu
10.6k2 gold badges25 silver badges46 bronze badges
answered Jun 8 at 3:06
MLuMLu
10.6k2 gold badges25 silver badges46 bronze badges
answered Jun 8 at 3:06
MLuMLu
10.6k2 gold badges25 silver badges46 bronze badges
answered Jun 8 at 3:06
MLuMLu
10.6k2 gold badges25 silver badges46 bronze badges
10.6k2 gold badges25 silver badges46 bronze badges
Thanks @Mlu, this is spot on. Thanks for the help
– kenlukas
Jun 10 at 18:41
add a comment |
Thanks @Mlu, this is spot on. Thanks for the help
– kenlukas
Jun 10 at 18:41
Thanks @Mlu, this is spot on. Thanks for the help
– kenlukas
Jun 10 at 18:41
Thanks @Mlu, this is spot on. Thanks for the help
– kenlukas
Jun 10 at 18:41
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f970613%2fswitch-role-on-windows10-fails-with-aws-source-ip%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
The Windows 7 and Mac behavior is what strikes me as unexpected. The console backend should be doing the legwork here rather than the browser, because the browser doesn't have the necessary credentials to make the call to STS... so I would have assumed that an AWS source IP would be expected, as a result.
– Michael - sqlbot
Jun 8 at 1:43