Amazon Workspaces is a managed desktop as a service that allows users to access virtual desktops hosted on AWS. To set up Workspaces, an administrator must launch the desktops, configure directories and networking, and install the Workspaces client. Workspaces provide flexible bundles and can integrate with existing directories, applications, and networks to provide a secure desktop experience to users.

1. AMAZON WORKSPACES
OVERVIEW
By John Louis Garcia
Senior AWS Architect
04/14/2020

2. Introduction
Amazon Workspaces is
a manage secured
Desktop as a Service
(DaaS) desktop
solution.

3. Getting Started
1. You must have an AWS account to create or administer a WorkSpace. Users do not need an AWS account
to connect to and use their WorkSpaces.
2. When you launch a WorkSpace, you must select a WorkSpace bundle. For more information, see Amazon
WorkSpaces Bundles.
3. When you launch a WorkSpace, you must specify profile information for the user, including a user name
and email address. Users complete their profiles by specifying a password. Information about
WorkSpaces and users is stored in a directory.
4. Amazon WorkSpaces is not available in every Region. Verify the supported Regions and select a Region
for your WorkSpaces. For more information about the supported Regions, see Amazon WorkSpaces
Pricing by AWS Region.

4. Options
1. Quick Setup
• For an individual / small group of cloud-based users.
2. Advanced Setup
• For advanced setup that includes on-premise connectivity, Microsoft AD with Amazon VPC

5. Requirements
A. Virtual Private Cloud
(VPC)
You’ll need a minimum of two subnets for a
WorkSpaces deployment because each AWS
Directory Service construct requires two subnets in
a Multi-AZ deployment.

6. Requirements
B. Directory Service
AD Connector — Use your existing on-premises Microsoft Active Directory. Users can
sign into their WorkSpaces using their on-premises credentials and access on-premises
resources from their WorkSpaces.
Microsoft AD — Create a Microsoft Active Directory hosted on AWS.
Simple AD — Create a directory that is compatible with Microsoft Active Directory,
powered by Samba 4, and hosted on AWS.
Cross trust — Create a trust relationship between your Microsoft AD directory and your
on-premises domain.
Amazon Cognito User Pools — With user pools, you can add user registration and sign-
in features to your apps. Users can sign in with an email address, phone number, or
username rather than use an external identity provider like Facebook or Google. You can
also create custom registration fields and store that metadata in your user directory. You
can verify email addresses and phone numbers, recover passwords, and enable multi-
factor authentication (MFA) with just a few lines of code.

7. Requirements
C. Workspaces Client
Android Client Application, iPad Client Application, Linux Client, Application, macOS
Client Application, PCoIP Zero Client, Web Access, Windows Client Application

8. Supported Regions
AWS Service Americas Europe/Middle East/Africa Asia Pacific
Amazon Workspaces Northern Virginia,
Oregon,
Montreal,
São Paulo,
AWS GovCloud (US-West)
Ireland, Frankfurt, London Singapore, Tokyo, Sydney,
Seoul, Ningxia*
Amazon Workspace
Application Manager
(WAM)
Northern Virginia,
Oregon,
Ireland Singapore, Sydney
Amazon Workdocs Northern Virginia,
Oregon,
Ireland Singapore, Tokyo, Sydney
https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/

9. Workspaces Diagram

10. Workspaces Diagram 2
USERS
AMAZON
WORKSPACES
CORPORATE
DATA CENTER
AWS CLOUD
* SERVERS
* APPLICATIONS
* DATABASES

11. Bundles and Images
A WorkSpace bundle is a combination of an operating system, and storage, compute, and
software resources. When you launch a WorkSpace, you select the bundle that meets your
needs. The default bundles available for WorkSpaces are called public bundles. For more
information about the various public bundles available for Amazon WorkSpaces, see Amazon
WorkSpaces Bundles.
If you've launched a Windows or Amazon Linux WorkSpace and have customized it, you can
create a custom image from that WorkSpace.
A custom image contains only the OS, software, and settings for the WorkSpace. A custom
bundle is a combination of both that custom image and the hardware from which a
WorkSpace can be launched.
Amazon WorkSpaces offers Amazon Linux WorkSpaces built on Amazon Linux 2 LTS, or
Windows 10 desktop experiences. The Windows 10 desktop experiences is powered by
Windows Server 2016. If your organization is eligible to bring their own Windows Desktop
licenses, you can run the Windows 10 Enterprise operating system on your Amazon
WorkSpaces.

12. Bundles and Images

13. Workspaces Application Manager (WAM)
Amazon WorkSpaces Application Manager
(Amazon WAM) offers a fast, flexible, and
secure way for you to deploy and manage
applications for Amazon WorkSpaces. Amazon
WAM accelerates software deployment,
upgrades, patching, and retirement by
packaging Microsoft Windows desktop
applications into virtualized application
containers. These applications run on the end-
user’s Amazon WorkSpaces instance as though
they are natively installed.

14. Amazon Workdocs
Amazon WorkDocs is a fully managed, secure content
creation, storage, and collaboration service. With
Amazon WorkDocs, you can easily create, edit, and
share content, and because it’s stored centrally on
AWS, access it from anywhere on any device. Amazon
WorkDocs makes it easy to collaborate with others,
and lets you easily share content, provide rich
feedback, and collaboratively edit documents. You can
use Amazon WorkDocs to retire legacy file share
infrastructure by moving file shares to the cloud.
Amazon WorkDocs lets you integrate with your
existing systems and offers a rich API so that you can
develop your own content-rich applications. Amazon
WorkDocs is built on AWS, where your content is
secured on the world's largest cloud infrastructure.

15. Launching a workspace
1. Workspace Administrator will launch the workspace. Administrator will select the directory, create the
user and add it to directory. Select the bundle and configure the workspace. Choose the running mode
(always on / autostop). Select encryption.
2. User will receive a verification email that will require the user to click on a provided URL. The email
will contain a registration code.
3. User will require a change of password.
4. User will use the registration when logging in from the workspace client.
5. User will need to download from https://clients.amazonworkspaces.com/ and install the workspace
client.

16. Workspace Limits
By default, a single AWS account can have a maximum of 5 WorkSpaces per region.
The following information must be included in the "Use case description" if the limit increase request is for more
than 200 WorkSpaces or more than 20 Graphics/GraphicsPro WorkSpaces:
Is this request for Coronavirus Disease 2019 (COVID-19) DR/BR planning purposes, or for a planned
rollout/scale up?
What percentage of your overall user base does this request cover?
What percentage of your users do you expect to use WorkSpaces if you have alternative method to have users
connect to your network such as VPN?
What percentage of your WorkSpaces will be using Always On running mode?
What percentage of your WorkSpaces will be using AutoStop running mode?
What bundle type(s) are you planning to use (Value, Standard, Performance, Power, PowerPro, Graphics,
GraphicsPro)?
If more than one type, please add approximate percentage for each.
What is the target date/date range to ramp up to these WorkSpaces?
Will you deploy them in batches or on demand if user requests?
Do you plan on using BYOL (dedicated hardware) WorkSpaces?

17. Workspaces Diagram 3
DEMO

18. Tips
1. The following ports needs to be allowed in your firewall.
• Web Browser (HTTPS 443)
• Application Client (TCP and UDP 4175)
2. A minimum of 1 Mbps per simultaneous user watching a 480p video window.
3. When designing a VPC, always think about the future scenarios. Design a network that has enough IP Ranges
for your requirements for you cannot rebuild this later.
4. When choosing a Directory Service, always think about the future scenarios. If you are resolving your DNS
from an Active Directory trust, don’t use Simple AD.
5. If you need to check which Region has the best latency from your location, go to
https://clients.amazonworkspaces.com/Health.html.
6. When you use the Workspace Application Manager (WAM) and you can’t see the shortcut icon from your
workspace desktop, reboot your workspace. If not open command prompt and do the following.
c:
cd C:Program FilesAmazon
WorkSpacesApplicationManager.exe
7. If you can’t see any applications in your WAM Application Client, go to APPS then choose DISCOVER.
8. Always be mindful on the supported regions.

19. Tips
9. Each WorkSpace is assigned to a single user and cannot be shared by multiple users.
10. By default, web access (browser) is disabled. To enable, go to directories, click on the dropdown and select
update details. Click on the Access Control Option and select “web access” on the list.
11. Workspace can also include Microsoft Office 2010, 2013, 2016. It comes with an additional cost.
12. You can build your own applications on WAM.
13. You can create group policies on your Microsoft Active Directory.
14. If you want to build your own catalog (apps) and use them in WAM, you will need to build WAM Servers
(WAM Player and WAM Studio). These servers doesn’t need to be hosted inside your workspace VPC. You can
deploy this to any VPC as long as it has an internet connection.
15. You can reset your user password by going to the aws directory services. Select your directory and click
reset user password.
16. You can also connect to the workspace via RDP as long the security groups allows it and the workspace has
access to the internet. Once connected, you will also need to authenticate to login.
17. You can restrict access only for trusted devices. You will need to create the certificates, deploy the client
cert to your trusted device and configure your setting from the AWS dashboard (Directories then Access
Control Options). https://docs.aws.amazon.com/workspaces/latest/adminguide/trusted-devices.html

20. Links
Amazon Workspaces Documentation
https://docs.aws.amazon.com/workspaces/index.html
User Guide
https://docs.aws.amazon.com/workspaces/latest/userguide/workspaces-ug.pdf
Best Practices
https://d1.awsstatic.com/whitepapers/workspaces/Best_Practices_for_Deploying_Ama
zon_WorkSpaces.pdf
Multi Factor Authentication
https://docs.aws.amazon.com/workspaces/latest/adminguide/update-directory-
details.html#connect-mfa
FAQ
https://aws.amazon.com/workspaces/faqs/