0

I am attempting to join a VM to a domain using a SSM document containing the aws:domainJoin command. My outbound security group is closed to the internet and there is no VPC endpoint for Active directory. The AWS endpoint is ds.us-east-2.amazonaws.com and I can see in the logs:

Domain Join failed, ... A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 52.95.18.130:443

on another attempt I see:

Domain Join failed, ... A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 52.95.16.150:443

The question is, what is the IP address range that supports the various endpoints such as ds.us-east-2.amazonaws.com.

Improve this question

1 Answer 1

Reset to default
0

No simple answer here unfortunately. There are multiple superblocks and also a number of smaller allocations for us-east-2 service region. The good news is you can download a json file that contains all the AWS IP blocks and get the ones that you're looking for. https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html

Improve this answer
4
  • I found a CIDR block in that file that matches. Unfortunately, the Service is listed as AMAZON (506 entries). So I got the idea to create a prefix list using the 506 AMAZON entries, but hit the 100 item limit. Is there an AWS owned Prefix list that encompasses the set of CIDRs? I cannot find one.
    – jlo-gmail
    Sep 9, 2021 at 17:42
  • 1
    Likely no. Many blocks are not contiguous.
    – t3ln3t
    Sep 9, 2021 at 18:02
  • But are you running the AWS managed AD? Doesn't it have ENIs in your VPC's subnets? why not use those? or if you're using your own AD have you considered using AD connector, it will have ENIs in your VPC and you can connect to those.
    – Oscar De León
    Sep 10, 2021 at 20:13
  • Per docs, the aws:domainJoin command must have access to ds.*.Amazon aws.com. This appears to be the case even when that command is provided my ADs DNS AND the VM can join the AD manually.
    – jlo-gmail
    Sep 22, 2021 at 15:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .