1

When a user on Windows 10 tries to switch roles in AWS it fails with

Failed authentication

failure Screenshot

We have a Condition in our sts:AssumeRole policy to only allow the role to switch if the user is coming from a white-listed IP address. Those addresses correspond to our NAT IP's. The user googles "what's my IP" and it returns the NAT IP we expect to see.

CloudTrail Screenshot

What's peculiar is the IP address in the CloudTrail logs is not our NAT IP. It is owned by AWS.

WHOIS screenshot

We have tried this in Chrome and Firefox with the same result. What I expect to happen is the user switches roles without an issue.

This issue does not occur when using Windows7 or MacOS.

Thoughts?

kenlukas
  • 3,101
  • 2
  • 16
  • 26
  • The Windows 7 and Mac behavior is what strikes me as unexpected. The console backend should be doing the legwork here rather than the browser, because the browser doesn't have the necessary credentials to make the call to STS... so I would have assumed that an AWS source IP would be expected, as a result. – Michael - sqlbot Jun 08 '19 at 01:43

1 Answers1

1

That address 76.223.160.183 is not AWS address. It doesn't show up in any advertised AWS range in any region. Verified with filter-ip-ranges.

Although the IP block is owned by by Amazon the relevant 76.223.160.0/21 was delegated to Netskope Inc, check your whois output again. From the Wikipedia article about Netskope:

Netskope [...] helps companies protect data and protect against threats in cloud applications, cloud infrastructure, and the web. [...] The solution steers cloud and Web traffic to a cloud-native service for the purposes of inspection and policy enforcement.

So my conclusion is that the Windows 10 laptop has some sort of Netskope service or plugin installed that redirects some traffic to Netskope servers for inspection. From there it's forwarded to AWS but as it comes from Netskope IP range it fails your IAM Condition.

BTW Why it doesn't interfere with "what's my IP" I'm not sure, probably some whitelist in the plugin.

Hope that helps :)

MLu
  • 24,849
  • 5
  • 59
  • 86