http://50.18.239.87:8080/manager/html 403 access denied, Tomcat Server is on EC2 instance

Question

Here are the context.xml and tomcat-users.xml files:

    <Context antiResourceLocking="false" privileged="true" docBase="${catalina.home}/webapps/manager">
  <CookieProcessor className="org.apache.tomcat.util.http.Rfc6265CookieProcessor"
                   sameSiteCookies="strict" />
  <!--Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" /-->
  <Manager sessionAttributeValueClassNameFilter="java\.lang\.(?:Boolean|Integer|Long|Number|String)|org\.apache\.catalina\.filters\.CsrfPreventionFilter\$LruCache(?:\$1)?|java\.util\.(?:Linked)?HashMap"/>
  <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="0.0.0.0/0" />
</Context>

Tomcat-users.xml:

<tomcat-users xmlns="http://tomcat.apache.org/xml"
              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
              version="1.0">
<!--
  By default, no user is included in the "manager-gui" role required
  to operate the "/manager/html" web application.  If you wish to use this app,
  you must define such a user - the username and password are arbitrary.

  Built-in Tomcat manager roles:
    - manager-gui    - allows access to the HTML GUI and the status pages
    - manager-script - allows access to the HTTP API and the status pages
    - manager-jmx    - allows access to the JMX proxy and the status pages
    - manager-status - allows access to the status pages only

  The users below are wrapped in a comment and are therefore ignored. If you
  wish to configure one or more of these users for use with the manager web
  application, do not forget to remove the <!.. ..> that surrounds them. You
  will also need to set the passwords to something appropriate.
-->

  <user username="admin" password="admin" roles="manager-gui"/>
  <user username="robot" password="robot" roles="manager-script"/>

<!--
  The sample user and role entries below are intended for use with the
  examples web application. They are wrapped in a comment and thus are ignored
  when reading this file. If you wish to configure these users for use with the
  examples web application, do not forget to remove the <!.. ..> that surrounds
  them. You will also need to set the passwords to something appropriate.
-->


  <role rolename="manager-gui"/>
  <role rolename="manager-script"/>     
  <role rolename="manager-status"/>
  <role rolename="admin-gui"/>
  <role rolename="admin-script"/>
  <user username="admin" password="admin" roles="manager-gui,manager-script,manager-status,admin-gui,admin-script" />


</tomcat-users>

Security group is configured for any inbound ip for port 8080.

Hit this URL and see the issue live: http://50.18.239.87:8080/manager/html

What could be causing this ?

Answer 1

By default, the Tomcat Manager application is restricted to be accessible only from the localhost (the same machine where Tomcat is running). If you need to access it from a different machine, you'll need to modify the Manager's context.xml file.

Search for the element related to the Tomcat Manager application. It should look something like this:

<Context antiResourceLocking="false" privileged="true" docBase="${catalina.home}/webapps/manager">
    <!-- Other configurations may be present here -->
</Context>

To allow access from a different machine, you need to add a Valve element within the element that allows requests from specific IP addresses or IP ranges. Replace the existing element with the following:

<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="your_ip_address_or_range" />

Replace your_ip_address_or_range with the IP address or range from which you want to allow access. For example, to allow access from any IP address, you can use allow="0.0.0.0/0". If you want to restrict access to specific IP addresses, specify those IP addresses or ranges accordingly.