IT organizations today need to support a modern, flexible, and global workforce and ensure that their users can be productive anywhere. Moving desktops and applications to the AWS Cloud offers improved security, scale, and performance with cloud economics. In this session, we provide an overview of Amazon WorkSpaces and Amazon AppStream 2.0, and we discuss use cases for each. Then, we dive deep into best practices for implementing Amazon WorkSpaces and AppStream 2.0, including how to integrate with your existing identity, security, networking, and storage solutions.

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Greg LaVigne
Specialized Solutions Architect − End User Computing, Amazon Web Services
ENT307
Move Your Desktops and Apps to AWS
with Amazon WorkSpaces
and Amazon AppStream 2.0

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What to expect from the session
• Overview of Amazon WorkSpaces
• Overview of Amazon AppStream 2.0
• Active Directory integration
• Access to corporate resources
• Bringing it all together
What are we covering

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security threats
In 2017, the average data
breach cost $3.62M
WannaCry ransomware
attack estimated to have
cost $4.0B
Evolving workforce
43% of US employees worked
remotely in 2016
Dynamic organizations
Global mergers and
acquisitions reached
$3.7T in 2017
Business landscape is changing

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What customers are telling us
What’s not working?
Personal computers
▪ Manage inventory
▪ Secure endpoints
▪ BYOD is complicated
▪ Data must be backed up
▪ Expensive to scale
On-premises VDI
▪ Upfront investment
▪ Weeks to deploy
▪ Requires management
▪ Servers must be secured
▪ Expensive to scale
Embrace
personal
devices
Support contract
workers
Access for
mobile workers
Data security Agility
Data storage
▪ Stored on multiple devices
▪ Limited control
▪ Accessing large files
▪ Collaborating
▪ Hard to secure

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS user compute solutions
Fully managed, secure virtual
cloud desktops running on
AWS
Easily stream desktop
applications to any device
running a web browser
Secure file collaboration and
management, simplified

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Managed cloud desktops
Secure
Pay as you go Simple to deploy
and manage
Provide high-performance persistent
cloud desktops to users
Scale and
consistent performance

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
End the PC lifecycle treadmill
Start PC
refresh
Deploy new
technology
Inventory
management
Build and
images
Service desk
support
Retirement
• Extend the life of your client
hardware
• Support BYOD
• Use PCs, macOS, tablets,
Chromebooks, and zero clients
• Support self-service
• Quickly scale up or down
• Use perpetual PCs in the cloud
• Move to opex model
Every
2–4
years

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Global organizations
Mobile workers
M&A activity
Developer productivity
Modern organizations
Temporary workers
Contractors
Training
Project-based work
Secure applications and data
Support BYOD
Meet compliance requirements
Security and compliance
Amazon WorkSpaces use cases

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon WorkSpaces – Hands-on labs

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Plays well with existing tools
Microsoft Active
Directory
Multi-factor
authentication
(MFA) (RADIUS)
SCCMIntranet
Amazon WorkSpaces integrates easily with your on-premises tools and network
Certificate
authority

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Improves security
Desktop stream
encrypted in transit
No sensitive data on
users’ devices
Amazon WorkSpaces data
encrypted at rest
Amazon WorkSpaces encrypts data and streams, and keeps information off devices

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Ready to meet security and compliance needs
PCI DSS
Level 1-compliant,
SOC 1, SOC 2, ISO
9001, and ISO 27001
certification
HIPAA-eligible with
business associate
agreement
EU General Data
Protection (GDPR)
ready
Manage access to
Amazon
WorkSpaces using
digital certificates

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Flexible billing options
HourlyMonthly
Best for
▪ Full-time staff
▪ Simplifying your AWS bill
▪ Instant access
▪ Running scheduled tasks
Best for
▪ Students and part-time staff
▪ Optimizing your AWS bill
▪ Quick access
▪ Running ad hoc tasks

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Customer success story: Endemol Shine Nederland
“With Amazon WorkSpaces, we can provide new workers with a
Windows desktop and the applications they need within hours
instead of days. Amazon WorkSpaces makes it easy for workers to use
their preferred device and for Endemol Shine Nederland to maintain
our security requirements. Because Amazon WorkSpaces is cost
effective and requires no upfront payment, we have been able to
save 30% of our desktop operations costs and 70% on capital
expenditure.”
Leon Backbier, IT Manager, Endemol Shine Nederland

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon WorkSpaces & Amazon AppStream customer and
partner success

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Secure, fully managed, file
collaboration and management
service with an extensible SDK
Anywhere access
Rich collaboration and
sharing
Pay as you go
Easily integrated
File collaboration and management

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon WorkSpaces and Amazon WorkDocs
• 50-GB free tier for Amazon WorkSpaces users
• Upgrade to 1 TB for $2 per user / month
• Amazon WorkDocs Drive can be a default user storage solution
+

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Fully managed application streaming service
that provides users instant access to their desktop applications

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Desktop application streaming
Stream desktop applications securely to
any web browser
Pay as you go
Secure
applications and data
No infrastructure
to manage
Scale globally

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Import existing apps with
no changes or rewrites
and start streaming
Integrates with existing
apps, identity,
entitlements, and
backend
No hardware or software
to install, add your apps
and start streaming
One streaming instance
per user –
no shared instances
Benefits of Amazon AppStream 2.0

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multiple instance families
• General purpose – Knowledge worker apps
• Compute-optimized – Compute-bound applications that benefit from high-
performance processors
• Memory-optimized – Applications that process large datasets in memory
• Graphics-optimized – High graphics requirements
One session: One VM = Consistent performance
Match app workload to instance characteristics:

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Graphics instance families
https://aws.amazon.com/blogs/compute/delivering-graphics-apps-with-amazon-appstream-2-0/
Instance family Graphics design
Graphics
desktop
Graphics
pro
Number of instance
sizes
4 1 3
Price $0.25–$2.00 $0.50 $2.05–$8.20
GPU memory 1–8 GiB 4 GiB 8–32 GiB
vCPU 2–16 8 16–64
Instance memory 8–61 GiB 15 GiB 122–488 GiB
GPU vendor AMD NVIDIA NVIDIA
Libraries supported
DirectX; OpenGL;
OpenCL
CUDA; DirectX;
OpenGL; OpenCL
CUDA; DirectX;
OpenGL; OpenCL

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Customer success story
“With AppStream 2.0, we can configure a single instance of E3D and deliver it to any
number of engineers training with AVEVA Experience anywhere in the world.
Because AppStream 2.0 runs inside their browser, customers don't need to worry
about configuring and securing their computers or network. They can immediately
start learning E3D with a responsive, fluid experience that is indistinguishable from a
native installation on a workstation.”
– Patrick Pando, VP Cloud Sales, AVEVA

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Deployment considerations

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The scenario
• Existing AWS customer
• Hybrid architecture, mix of applications on premises and in the cloud
• Existing Active Directory environment for identity
• AWS Direct Connect already in place
• 4,000+ users
• ~30% contingent workforce
• ~10% with high performance or GPU workloads
Mergers and
acquisitions
BYOD Mobile workers Temporary
workforce
Secure
access

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The approach
• Decide on user segmentation
• Select the initial use cases
• Evaluate performance
characteristics
• Build the pilot solution
• Run user acceptance testing
• Deploy
• Iterate!

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS account structure
Primary / Payer account
Logging Config Billing
Dev
Prod
User
…Isolated app /
Third party
Shared services
Active Directory
MFA AD FS
…
All log files flow to primary
VPC/VPN
Peering
Linked accounts
Key recommendations
• Payer / linked account structure
• Only central logging in payer account
• User environment in
separate account

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Network design – subnets
✓ Amazon WorkSpaces requires two subnets in
different Availability Zones
✓ Amazon AppStream 2.0 should be deployed across
two subnets in different Availability Zones
✓ Size subnets to accommodate the target end-state
capacity

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Elastic network interfaces
✓ An instance in either service has two network
interfaces
➢ ETH0 is the service interface
➢ ETH1 is the interface in your VPC
✓ Routing rules and security groups affect ETH1; you
have full control of this interface
✓ User traffic can route to file servers, backend
databases, licensing servers, and so on, either in your
VPC, in a peered VPC, or on premises

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
• All Amazon WorkSpaces will be joined to
an Active Directory domain
• AWS Directory Service is required to
connect users to their Amazon WorkSpace
• Fleets can be domain-joined or
standalone
• AD-joined fleets integrate via
SAML with your identity provider
Directory integration

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Active Directory recommendations
✓ Extend your Active Directory into AWS on Amazon
EC2 instances
✓ Use cross-account VPC peering for
communications to a shared services VPC
✓ Define your VPCs in Active Directory Sites and
Services
✓ Separate Active Directory OUs by service and
region

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Demo

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Global availability

35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Try it now
Try Amazon WorkSpaces; Free Tier
available!
Run two Standard bundle
WorkSpaces for 40 hours a month,
for up to two calendar months
Amazon Linux 2, Windows 7, or
Windows 10 Experience, including
Amazon WorkDocs with 50-GB
storage
Try Amazon AppStream 2.0 with
no setup required!
Try sample applications –
business, design, engineering,
and developer
Upload your own files, test a
workflow, save your work, and
print
Try Amazon WorkDocs; Free
Tier available!
30-day free trial with 1 TB of
storage per user for up to 50
users
Amazon WorkSpaces users
receive access to Amazon
WorkDocs for no additional
charge

36. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Submit session feedback
1. Tap the Schedule icon.
2. Select the session you attended.
3. Tap Session Evaluation to submit your
feedback.

37. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you!