The document discusses moving desktops and applications to AWS using Amazon WorkSpaces and Amazon AppStream 2.0. It provides an overview of the services, how they integrate with Active Directory and allow access to corporate resources. Examples are given of how customers have used the services for mobile workforces and temporary workers. The presentation concludes by demonstrating how to set up a pilot solution using the services and network architecture recommendations.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Move Your Desktops and
Applications to AWS with Amazon
WorkSpaces and AppStream 2.0
Jeff Ferris
Senior Manager, Solutions Architecture
Amazon Web Services
B A P 3 2 3

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
• Overview of Amazon WorkSpaces
• Overview of Amazon AppStream 2.0
• Active Directory integration
• Access to corporate resources
• Bringing it all together

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security threats
In 2017, the average
data breach cost $3.62M
WannaCry ransomware
attack estimated to have
cost $4.0B
Evolving workforce
43% of US employees
worked remotely in 2016
Dynamic organizations
Global mergers and
acquisitions reached
$3.7T in 2017
Business landscape is changing

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What customers are telling us
What’s not
working?
Personal computers
 Manage inventory
 Secure endpoints
 BYOD is complicated
 Data must be backed up
 Expensive to scale
On-premises VDI
 Upfront investment
 Weeks to deploy
 Requires management
 Servers must be secured
 Expensive to scale
Embrace
personal
devices
Support contract
workers
Access for
mobile
workers
Data security Agility
Data storage
 Stored on multiple devices
 Limited control
 Accessing large files
 Collaborating
 Hard to secure

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS end user compute solutions
Fully managed, secure
virtual cloud desktops
running on AWS
Easily stream desktop
applications to any device
running a web browser
Secure file collaboration
and management,
simplified

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Managed cloud desktops
Secure
Pay-as-you-go
Secure, managed
cloud desktops your
users will love
Simple to deploy
and manage
Scale & consistent
performance

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
End the PC lifecycle treadmill
Start PC
refresh
Deploy new
technology
Inventory
management
Build
and
images
Service
desk
support
Retirement
• Extend the life of your client
hardware
• Support BYOD
• Use PCs, macOS, tablets,
Chromebooks, and zero
clients
• Support self-service
• Quickly scale up or down
• Use perpetual PCs in the
cloud
• Move to OPEX model
Every
2–4
years

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Global organizations
Mobile workers
M&A activity
Developer productivity
Modern organizations
Temporary workers
Contractors
Training
Project-based work
Secure applications and data
Support BYOD
Meet compliance requirements
Security and compliance
Amazon WorkSpaces use cases

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS re:Invent hands-on labs

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Plays well with existing tools
Microsoft Active
Directory
Multi-factor
authentication
(MFA) (RADIUS)
SCCMIntranet
Amazon WorkSpaces integrates easily with your on-premises tools and network
Certificate
authority

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Improves security
Desktop stream
encrypted in transit
No sensitive data
on users’ devices
Storage
encrypted at rest
Amazon WorkSpaces encrypts data and streams, and
keeps information off devices

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Ready to meet security and compliance needs
PCI DSS
Level 1-
compliant,
SOC 1, SOC 2,
ISO 9001, and
ISO 27001
certification
HIPAA-eligible
with business
associate
agreement
EU General Data
Protection
(GDPR) ready
Manage access to
Amazon
WorkSpaces
using digital
certificates

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Flexible billing options
HourlyMonthly
Best for
 Full-time staff
 Simplifying your AWS bill
 Instant access
 Running scheduled tasks
Best for
 Students and part-time staff
 Optimizing your AWS bill
 Quick access
 Running ad hoc tasks

16. “With Amazon WorkSpaces, we can provide new workers
with a Windows desktop and the applications they need
within hours instead of days. Amazon WorkSpaces
makes it easy for workers to use their preferred device
and for Endemol Shine Nederland to maintain our
security requirements. Because Amazon WorkSpaces is
cost effective and requires no upfront payment, we have
been able to save 30% of our desktop operations costs
and 70% on capital expenditure.”
– Leon Backbier
IT Manager
Endemol Shine Nederland

17. “We were able to use Amazon WorkSpaces to help us get a new,
Master’s level course up and running in less than three weeks
and provide students with access to industry-relevant
applications integrated into the course and labwork. With this
approach, students get real hands-on experience, using real
industry tools with Amazon WorkSpaces. They aren’t just
taking notes in class, but following me in real time. It gets rid
of traditional classroom barriers. With Amazon WorkSpaces,
students can study and work together on their projects
anywhere, on Macs, PCs, and tablets. The flexibility for them is
the icing on the cake. We can rethink how we teach with
Amazon WorkSpaces. We can offer more to students – more
interesting class content and more interactivity – without
adding complexity for instructors. The sky is the limit.”
- Jeff Christen, Instructor, Cornell University

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon WorkSpaces & Amazon AppStream customer and partner
success

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Secure, fully managed, file
collaboration and management
service with an extensible SDK
Anywhere access
Rich collaboration and
sharing
Pay as you go
Easily integrated
File collaboration and management

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon WorkSpaces and Amazon WorkDocs
• 50 GB free tier for Amazon WorkSpaces users
• Upgrade to 1 TB for $2 per user / month
• Amazon WorkDocs Drive can be a default
user storage solution
+

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Fully managed application streaming service
that provides users instant access to their desktop applications

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Desktop application streaming
Stream desktop applications
securely to any web browserPay as you go
Secure
applications and data
No infrastructure
to manage
Scale globally

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Benefits of Amazon AppStream 2.0
Import existing
apps with no
changes or
rewrites and start
streaming
Integrates with
existing apps,
identity,
entitlements, and
backend
No hardware or
software to install;
add your apps and
start streaming
One streaming
instance per user
− no shared
instances

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Managed streaming solution
for desktop applications
Business and
public sector
Move desktop applications
to cloud with no rewrite
ISVs
Pre- and post-process
visualization on AWS
Design and engineering
Amazon AppStream 2.0 use cases

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multiple instance families
• General purpose – Knowledge worker apps
• Compute optimized – Compute-bound applications that
benefit from high-performance processors
• Memory optimized – Applications that process large
datasets in memory
• Graphics optimized – High graphics requirements
One session: One VM = Consistent performance
Match app workload to instance characteristics:

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Graphics Instance Families
https://aws.amazon.com/blogs/compute/delivering-graphics-apps-with-amazon-appstream-2-0/
Instance Family
Graphics
Design
Graphics
Desktop
Graphics
Pro
Number of
instance sizes
4 1 3
Price $0.25–$2.00 $0.50 $2.05–$8.20
GPU Memory 1–8 GiB 4 GiB 8–32 GiB
vCPU 2–16 8 16–64
Instance Memory 8–61 GiB 15 GiB 122–488 GiB
GPU Vendor AMD NVIDIA NVIDIA
Libraries
Supported
DirectX; OpenGL;
OpenCL
CUDA; DirectX;
OpenGL; OpenCL
CUDA; DirectX;
OpenGL; OpenCL

27. “With AppStream 2.0, we can configure a single instance of E3D and
deliver it to any number of engineers training with AVEVA Experience
anywhere in the world. Because AppStream 2.0 runs inside their
browser, customers don't need to worry about configuring and
securing their computers or network. They can immediately start
learning E3D with a responsive, fluid experience that is
indistinguishable from a native installation on a workstation.”
– Patrick Pando, VP Cloud Sales

28. "AppStream 2.0 helps our prospects start their SOLIDWORKS trials in
seconds through their browser with no downloads or installation on
their local computer. Because AppStream 2.0 provides GPU optimized
instances, our users have an experience indistinguishable from their
local graphics workstation. This reduces the time it takes for users to
complete trials of the latest version of SOLIDWORKS, in some cases
from weeks to hours.“
– Suchit Jain, VP Strategy & Business Development

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The scenario
• Existing AWS customer
• Hybrid architecture, mix of applications on premises and in the cloud
• Existing Active Directory environment for Identity
• AWS Direct Connect already in place
• 4,000+ users
•~30% contingent workforce
•~10% with high performance or GPU workloads
Mergers and
acquisitions
BYOD Mobile workers Temporary
workforce
Secure
access

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The approach
• Decide on user segmentation
• Select the initial use cases
• Evaluate performance
characteristics
• Build the pilot solution
• Run user acceptance testing
• Deploy
• Iterate!

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS account structure
Primary/Payer account
Logging Config Billing
Dev
Prod
User
…Isolated app /
third party
Shared services
AD MFA ADFS
…
All log files flow to primary
VPC/VPN
Peering
Linked accounts
Key recommendations
• Payer / linked account structure
• Only central logging in payer
account
• User environment in
separate account

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Network design – Subnets
 Amazon WorkSpaces requires two subnets in
different Availability Zones.
 Amazon AppStream 2.0 should be deployed
across two subnets in different Availability Zones.
 Size subnets to accommodate the target end-
state capacity.

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Elastic network interfaces
 An instance in either service has two network
interfaces
 ETH0 is the service interface
 ETH1 is the interface in your VPC
 Routing rules and security groups affect ETH1; you
have full control of this interface
 User traffic can route to file servers, backend
databases, licensing servers, and so on, either in your
VPC, in a peered VPC, or on premises

35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Directory integration
• All Amazon WorkSpaces will be
joined to an Active Directory
domain
• AWS Directory Service is required
to connect users to their Amazon
WorkSpace
• Fleets can be domain-
joined or standalone
• AD-joined fleets integrate
via SAML with your identity
provider

36. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Active Directory recommendations
 Extend your Active Directory into AWS on Amazon EC2 instances
 Use cross-account VPC peering for
communications to a Shared Services VPC
 Define your VPCs in Active Directory
Sites and Services
 Separate Active Directory OUs by service and region

37. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Global availability

38. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Try it now
Try Amazon WorkSpaces; Free
Tier available!
https://aws.amazon.com/free/
Run two Standard bundle
WorkSpaces for 40 hours a
month, for up to two calendar
months
Amazon Linux 2, Windows 7 or
Windows 10 Experience, including
Amazon WorkDocs with 50 GB
storage
Try Amazon AppStream 2.0
with no setup required!
Try sample applications –
business, design, engineering,
and developer
Upload your own files, test a
workflow, save your work,
and print
Try Amazon WorkDocs; Free
Tier available!
30-day free trial with 1 TB of
storage per user for up to 50
users
Amazon WorkSpaces users
receive access to Amazon
WorkDocs for no additional
charge
https://aws.amazon.com/free/

39. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Related sessions
Thursday, November 29th
BAP305: How to move to Amazon WorkSpaces and replace your legacy VDI
1:45 p.m. – 2:45 p.m. | MGM, Level 3, Premier Ballroom 319, T2
Friday, November 30th
BAP323: Move your Desktops and Applications to AWS with Amazon
WorkSpaces and AppStream 2.0
10:00 a.m. – 11:00 a.m. | Venetian, Level 4, Lando 4202, T1
Tuesday, November 27th
BAP204: Using AWS End User Computing services for your modern workforce
10:00 a.m. – 11:00 a.m. | Mirage, Grand Ballroom F, T1

40. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

41. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.