From 4a9732315177a94771f068bb17e2acd70af12561 Mon Sep 17 00:00:00 2001 From: Andrew Asseily Date: Thu, 2 Jul 2026 10:36:48 -0400 Subject: [PATCH 1/4] Add China partition domains to SSO start URL resolver allowlist --- awscli/customizations/sso/resolve.py | 14 ++++++++++++-- tests/unit/customizations/sso/test_resolve.py | 15 +++++++++++++++ 2 files changed, 27 insertions(+), 2 deletions(-) diff --git a/awscli/customizations/sso/resolve.py b/awscli/customizations/sso/resolve.py index 21c3e84843f8..9332a6c7243a 100644 --- a/awscli/customizations/sso/resolve.py +++ b/awscli/customizations/sso/resolve.py @@ -26,10 +26,15 @@ _AWS_OWNED_SUFFIXES = ( '.app.aws', '.portal.amazonaws.com', + '.portal.amazonaws.com.cn', '.awsapps.com', + '.awsapps.cn', ) -_AWS_OWNED_EXACT = 'identitycenter.amazonaws.com' +_AWS_OWNED_EXACT = ( + 'identitycenter.amazonaws.com', + 'identitycenter.amazonaws.com.cn', +) _REGION_PATTERNS = ( # {idcInstanceId}.portal.{region}.app.aws @@ -41,6 +46,11 @@ r'^[^.]+\.(?P[a-z0-9-]+)\.portal\.amazonaws\.com$', re.IGNORECASE, ), + # {idcInstanceId}.{region}.portal.amazonaws.com.cn + re.compile( + r'^[^.]+\.(?P[a-z0-9-]+)\.portal\.amazonaws\.com\.cn$', + re.IGNORECASE, + ), ) _MAX_REDIRECTS = 1 @@ -61,7 +71,7 @@ def _normalize_url(url): def is_aws_owned_domain(hostname): hostname = hostname.lower().rstrip('.') - if hostname == _AWS_OWNED_EXACT: + if hostname in _AWS_OWNED_EXACT: return True for suffix in _AWS_OWNED_SUFFIXES: if hostname == suffix.lstrip('.'): diff --git a/tests/unit/customizations/sso/test_resolve.py b/tests/unit/customizations/sso/test_resolve.py index 6f236018f893..e5a883003680 100644 --- a/tests/unit/customizations/sso/test_resolve.py +++ b/tests/unit/customizations/sso/test_resolve.py @@ -39,6 +39,11 @@ class TestIsAwsOwnedDomain: 'awsapps.com', 'identitycenter.amazonaws.com', 'identitycenter.amazonaws.com.', + 'd-abc123.awsapps.cn', + 'myalias.awsapps.cn', + 'ssoins-abc123.cn-north-1.portal.amazonaws.com.cn', + 'ssoins-abc123.cn-northwest-1.portal.amazonaws.com.cn', + 'identitycenter.amazonaws.com.cn', ], ) def test_aws_owned_returns_true(self, hostname): @@ -56,6 +61,9 @@ def test_aws_owned_returns_true(self, hostname): 'notidentitycenter.amazonaws.com', 'example.com', '', + 'awsapps.cn.evil.net', + 'evil-awsapps.cn', + 'portal.amazonaws.com.cn.evil.net', ], ) def test_non_aws_owned_returns_false(self, hostname): @@ -72,6 +80,11 @@ class TestExtractRegionFromHostname: ('ssoins-abc.portal.cn-north-1.app.aws', 'cn-north-1'), ('ssoins-abc.us-gov-west-1.portal.amazonaws.com', 'us-gov-west-1'), ('ssoins-abc.us-west-2.portal.amazonaws.com', 'us-west-2'), + ('ssoins-abc.cn-north-1.portal.amazonaws.com.cn', 'cn-north-1'), + ( + 'ssoins-abc.cn-northwest-1.portal.amazonaws.com.cn', + 'cn-northwest-1', + ), ], ) def test_extracts_region(self, hostname, expected_region): @@ -81,7 +94,9 @@ def test_extracts_region(self, hostname, expected_region): 'hostname', [ 'd-abc123.awsapps.com', + 'd-abc123.awsapps.cn', 'identitycenter.amazonaws.com', + 'identitycenter.amazonaws.com.cn', 'aws.mycompany.com', ], ) From d261619ba7b6bd81a138cade2d12d277a2e2559c Mon Sep 17 00:00:00 2001 From: Andrew Asseily Date: Thu, 2 Jul 2026 10:44:41 -0400 Subject: [PATCH 2/4] Add changelog entry --- .changes/next-release/bugfix-sso-17448.json | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changes/next-release/bugfix-sso-17448.json diff --git a/.changes/next-release/bugfix-sso-17448.json b/.changes/next-release/bugfix-sso-17448.json new file mode 100644 index 000000000000..3d948730ed5e --- /dev/null +++ b/.changes/next-release/bugfix-sso-17448.json @@ -0,0 +1,5 @@ +{ + "type": "bugfix", + "category": "``sso``", + "description": "Fix SSO login failure for China partition URLs" +} From 67dc7d50f13177cd4b7b9de483ebf4491a77db81 Mon Sep 17 00:00:00 2001 From: Andrew Asseily Date: Thu, 2 Jul 2026 12:24:16 -0400 Subject: [PATCH 3/4] Add EUSC, and DualStack partition domains to SSO start URL resolver allowlist --- awscli/customizations/sso/resolve.py | 18 ++++++++++++++++++ tests/unit/customizations/sso/test_resolve.py | 15 +++++++++++++++ 2 files changed, 33 insertions(+) diff --git a/awscli/customizations/sso/resolve.py b/awscli/customizations/sso/resolve.py index 9332a6c7243a..442e8a659657 100644 --- a/awscli/customizations/sso/resolve.py +++ b/awscli/customizations/sso/resolve.py @@ -27,6 +27,9 @@ '.app.aws', '.portal.amazonaws.com', '.portal.amazonaws.com.cn', + '.app.amazonwebservices.com.cn', + '.portal.amazonaws.eu', + '.api.amazonwebservices.eu', '.awsapps.com', '.awsapps.cn', ) @@ -51,6 +54,21 @@ r'^[^.]+\.(?P[a-z0-9-]+)\.portal\.amazonaws\.com\.cn$', re.IGNORECASE, ), + # {idcInstanceId}.portal.{region}.app.amazonwebservices.com.cn + re.compile( + r'^[^.]+\.portal\.(?P[a-z0-9-]+)\.app\.amazonwebservices\.com\.cn$', + re.IGNORECASE, + ), + # {idcInstanceId}.{region}.portal.amazonaws.eu + re.compile( + r'^[^.]+\.(?P[a-z0-9-]+)\.portal\.amazonaws\.eu$', + re.IGNORECASE, + ), + # {idcInstanceId}.portal.{region}.api.amazonwebservices.eu + re.compile( + r'^[^.]+\.portal\.(?P[a-z0-9-]+)\.api\.amazonwebservices\.eu$', + re.IGNORECASE, + ), ) _MAX_REDIRECTS = 1 diff --git a/tests/unit/customizations/sso/test_resolve.py b/tests/unit/customizations/sso/test_resolve.py index e5a883003680..5ad2e45167d3 100644 --- a/tests/unit/customizations/sso/test_resolve.py +++ b/tests/unit/customizations/sso/test_resolve.py @@ -44,6 +44,9 @@ class TestIsAwsOwnedDomain: 'ssoins-abc123.cn-north-1.portal.amazonaws.com.cn', 'ssoins-abc123.cn-northwest-1.portal.amazonaws.com.cn', 'identitycenter.amazonaws.com.cn', + 'ssoins-abc123.portal.cn-north-1.app.amazonwebservices.com.cn', + 'ssoins-abc123.eusc-de-east-1.portal.amazonaws.eu', + 'ssoins-abc123.portal.eusc-de-east-1.api.amazonwebservices.eu', ], ) def test_aws_owned_returns_true(self, hostname): @@ -85,6 +88,18 @@ class TestExtractRegionFromHostname: 'ssoins-abc.cn-northwest-1.portal.amazonaws.com.cn', 'cn-northwest-1', ), + ( + 'ssoins-abc.portal.cn-north-1.app.amazonwebservices.com.cn', + 'cn-north-1', + ), + ( + 'ssoins-abc.eusc-de-east-1.portal.amazonaws.eu', + 'eusc-de-east-1', + ), + ( + 'ssoins-abc.portal.eusc-de-east-1.api.amazonwebservices.eu', + 'eusc-de-east-1', + ), ], ) def test_extracts_region(self, hostname, expected_region): From 49731d3624e7099945302c6fc3e722f076040d2d Mon Sep 17 00:00:00 2001 From: Andrew Asseily Date: Thu, 2 Jul 2026 12:27:13 -0400 Subject: [PATCH 4/4] Update changelog --- .changes/next-release/bugfix-sso-17448.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changes/next-release/bugfix-sso-17448.json b/.changes/next-release/bugfix-sso-17448.json index 3d948730ed5e..81b029515b3e 100644 --- a/.changes/next-release/bugfix-sso-17448.json +++ b/.changes/next-release/bugfix-sso-17448.json @@ -1,5 +1,5 @@ { "type": "bugfix", "category": "``sso``", - "description": "Fix SSO login failure for China partition URLs" + "description": "Fix SSO login failure for non-commercial partition URLs (China and EUSC)" }