aws sso login broken for GovCloud (us-gov) Identity Center URLs: same as #10464, partition not covered by the #10465 fix

[max-valid-eval]

Describe the bug

aws sso login cannot authenticate against an AWS GovCloud (US) IAM Identity Center instance when sso_start_url is the issuer-URL form (https://identitycenter.us-gov.amazonaws.com/ssoins-XXXX).

This is #10464 in the aws-us-gov partition. #10464 reported the same failure for China after the vanity-URL feature (#10457) shipped in 2.35.13. #10465 fixed it by expanding _AWS_OWNED_EXACT / _AWS_OWNED_SUFFIXES to cover China and EUSC, and #10493 added the remaining EUSC issuer domain. us-gov was never added and is still missing as of 2.36.2.

resolve_start_url() classifies start URLs against an allowlist of AWS-owned hostnames. Recognised hosts short-circuit and are never resolved or fetched. Unrecognised hosts go to _follow_redirect(), which issues an HTTP HEAD. Because us-gov is absent from the allowlist, the GovCloud issuer URL takes the redirect path — but that hostname is an identifier, not an endpoint and has no DNS record in any resolver, so the HEAD fails in getaddrinfo().

This is a regression. Last working release 2.35.12; first affected 2.35.13.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

The GovCloud Identity Center issuer URL is recognised as AWS-owned, resolve_start_url() returns (start_url, sso_region) without any DNS lookup or HTTP request, and device authorization proceeds against oidc.us-gov-west-1.amazonaws.com, which resolves normally.

Current Behavior

$ aws sso login --profile gov
aws: [ERROR]: An error occurred (Configuration): Failed to resolve start URL:
[Errno 8] nodename nor servname provided, or not known

The browser never opens; device authorization is never reached.

--debug shows the classification decision immediately before the failure:

awscli.customizations.sso.resolve - DEBUG - Start URL
  'https://identitycenter.us-gov.amazonaws.com/ssoins-XXXX'
  is not AWS-owned, following redirects
awscli.customizations.sso.resolve - DEBUG - Issuing HEAD request to '...'

Traceback (most recent call last):
    for res in getaddrinfo(host, port, 0, SOCK_STREAM):
socket.gaierror: [Errno 8] nodename nor servname provided, or not known

  File ".../awscli/customizations/sso/resolve.py", line 136, in _follow_redirect
    raise URLError(err)
urllib.error.URLError: <urlopen error [Errno 8] nodename nor servname provided, or not known>

  File ".../awscli/customizations/sso/resolve.py", line 197, in _follow_redirect
    raise ConfigurationError(
awscli.customizations.exceptions.ConfigurationError:
  Failed to resolve start URL: [Errno 8] nodename nor servname provided, or not known

The error implies the configured sso_start_url is malformed. It is not — it is the value the AWS access portal issues.

Reproduction Steps

[profile gov]
sso_session = gov
sso_account_id = 123456789012
sso_role_name = PowerUserAccess
region = us-gov-east-1

[sso-session gov]
sso_start_url = https://identitycenter.us-gov.amazonaws.com/ssoins-XXXXXXXXXXXXXXXX
sso_region = us-gov-west-1
sso_registration_scopes = sso:account:access

$ aws sso login --profile gov
Fails immediately, before any browser interaction. Add --debug to see the is not AWS-owned, following redirects classification.

Does not require a GovCloud account to confirm the cause — the classification is a pure function of the hostname:

$ python3 -c "
from awscli.customizations.sso.resolve import is_aws_owned_domain
for h in ['identitycenter.amazonaws.com',
          'identitycenter.amazonaws.com.cn',
          'identitycenter.amazonaws.eu',
          'identitycenter.us-gov.amazonaws.com']:
    print(f'{is_aws_owned_domain(h)!s:<6} {h}')
"
True   identitycenter.amazonaws.com
True   identitycenter.amazonaws.com.cn
True   identitycenter.amazonaws.eu
False  identitycenter.us-gov.amazonaws.com

Possible Solution

Mirror #10465, one line in awscli/customizations/sso/resolve.py:

_AWS_OWNED_EXACT = (
    'identitycenter.amazonaws.com',
    'identitycenter.amazonaws.com.cn',
    'identitycenter.amazonaws.eu',
    'identitycenter.us-gov.amazonaws.com',   # GovCloud (US)
)

Worth auditing in the same pass, since the partition was missed consistently:

_AWS_OWNED_SUFFIXES has no us-gov portal or app suffix, so other GovCloud portal URL forms may hit the same path.
_REGION_PATTERNS has no us-gov pattern, so region cannot be inferred from a GovCloud hostname. Not fatal since sso_region comes from config, but it is the same omission.
When _follow_redirect() fails with EAI_NONAME or a 404, the message could say the host was unrecognised and unreachable, rather than implying the configured URL is malformed. Both #10464 and this report lost significant time to that wording.
tests/unit/customizations/sso/test_resolve.py already enumerates commercial, China and EUSC hosts. A partition matrix including us-gov would have caught this on the first pass.

Additional Information/Context

Regression bisect. Introduced by #10457 "Add vanity URL support" (67e1b58, 2026-06-30). resolve.py is absent at 2.35.11 and 2.35.12, and present with the classification gate at 2.35.13. At that release the allowlist was commercial-only, as a bare string:

No us-gov string exists in the file at any release since: 2.35.13, 2.35.16, 2.35.20, 2.35.23, 2.36.0, 2.36.1, 2.36.2.

ref	partition	outcome
#10464 (issue, bug/sso/p1)	China	fixed by #10465, closed in 4 days
#10465 (PR)	China + EUSC	_AWS_OWNED_EXACT → tuple; added .com.cn, .awsapps.cn, .portal.amazonaws.com.cn, .portal.amazonaws.eu
#10493 (PR)	EUSC	added identitycenter.amazonaws.eu
this report	us-gov	not yet addressed

ref partition outcome
#10464 (issue, bug/sso/p1) China fixed by #10465, closed in 4 days
#10465 (PR) China + EUSC _AWS_OWNED_EXACT → tuple; added .com.cn, .awsapps.cn, .portal.amazonaws.com.cn, .portal.amazonaws.eu
#10493 (PR) EUSC added identitycenter.amazonaws.eu
this report us-gov not yet addressed

CLI version used

aws-cli/2.36.2 Python/3.14.6 Darwin/25.5.0 source/arm64 (also reproduced on 2.35.23; first affected 2.35.13)

Environment details (OS name and version, etc.)

macOS 15 (Darwin 25.5.0) arm64; reproduced on both Homebrew (source/arm64) and official pkg (exe/arm64) installs; partition aws-us-gov, Identity Center in us-gov-west-1

[AndrewAsseily]

Thanks for reporting this @max-valid-eval. Fix is up in #10503.
We're also looking at making the resolver degrade gracefully so unrecognized-but-valid AWS domains don't take down login while we catch up on formats.

[AndrewAsseily]

The fix should now be included in the latest version 2.36.4