Blocking Access to AWS Console based on AWS Account Number

[shocko]

We use AWS accounts in our org as we have VMs etc. in AWS. As such we need to allow access to logon to https://signin.aws.amazon.com/. My query is around restricting the accounts that can logon. We have enterprise accounts but have noticed people logging into their own personal accounts. Has anyone done anything clever here with SSL interception ?

[asabban · Accepted solution]

Hello,

check with AWS if they offer a "Tenant Restriction", so we can add some value to the headers on the proxy which is respected by AWS. This works for some other applications, such as Office 365 or Google Apps, maybe AWS offers a similar feature.

If not lets take a look at the POST when logging in. The POST will contain the mail address... we can read this information on the MWG usually and compare it against a list of allowed values. If someone tries to login with a mail address you don't like - we can block the login request.

Andre

[shocko]

I don't see it offered 😐