ACKF logoACKF
End User Computing

Amazon WorkSpaces

View on GitHub

Amazon WorkSpaces

A managed Desktop-as-a-Service that provisions persistent virtual Windows or Linux desktops in AWS. It operates by launching and maintaining WorkSpace instances in a customer VPC and authenticating users via directory services. It normally fits where organisations need centrally managed user desktops accessible from remote devices with integration into corporate identity and networking.

🗂 Resource Category

End User Computing • Security, Identity, and Compliance

🧠 Exam Memory Hook

Think: "Managed persistent cloud desktops + AD integration + VPC access = Amazon WorkSpaces"

📖 Ownership

Classification: Shared Responsibility Service

AWS responsibilities: AWS operates and maintains the WorkSpaces control plane, the underlying physical infrastructure, hypervisor, service APIs, and the managed service platform including networking endpoints used by WorkSpaces. AWS is responsible for the availability and security of the AWS-managed infrastructure, the WorkSpaces service components, and patching those AWS-owned systems. AWS provides service-level tooling for creating and provisioning WorkSpaces and may publish and maintain public WorkSpaces images or bundles.

Customer responsibilities: The customer configures directories, VPC networking, security groups, IAM policies, WorkSpace bundles or custom images, user assignments, and access controls; secures user data and applications; monitors WorkSpaces and logs; and manages backups or archives of user data when required. The customer is responsible for installing and maintaining applications, applying patches to guest operating systems for custom images, managing user profiles and policies, and enforcing endpoint security on client devices.

Patching responsibilities: AWS patches the physical infrastructure, networking infrastructure, hypervisor, and the WorkSpaces control plane/service platform. For guest operating systems and application stacks, responsibility depends on the image model: customers patch guest OS, runtimes, libraries, dependencies, and customer applications for custom images; when using AWS-provided or AWS-maintained public images, AWS may publish updated images but customers must still validate and apply updates to their deployed environments and any additional software they install.

🏗 Typical Architecture

💡 Top 5 Features

  • Provision persistent managed virtual desktops (Windows or Linux) in the cloud per user.
  • Support for custom images and predefined bundles to include OS and application configurations.
  • Integration with corporate directories for user authentication and group policy enforcement.
  • Selectable hardware bundles including CPU, memory, and GPU profiles for different user needs.
  • Support for encryption of WorkSpace storage and TLS-secured client connections when configured.

✅ Top 5 Use Cases

  • Provide remote employees with centrally managed persistent desktops that connect to corporate networks via VPC.
  • Deliver GPU-accelerated desktops for designers or engineers requiring graphics-capable cloud desktops.
  • Offer temporary or contractor desktops that can be provisioned and revoked without on-premises hardware.
  • Centralise desktop image management and software distribution using custom WorkSpaces images and directory policies.
  • Enable secure access to internal applications for regulated workloads by isolating desktops in a VPC and integrating with corporate identity.

🏗 Architecture Placement

Amazon WorkSpaces runs in a customer AWS account and launches desktop instances into a VPC; user devices connect over the Internet or private networking to WorkSpaces clients which authenticate via directory services. It commonly connects to directory services for identity, file services such as FSx for user storage, and monitoring services such as CloudWatch. Placement is regional and VPC-based, and network, IAM, and directory configuration determine access and connectivity.

🎯 Commonly Used With

- Amazon VPC
- AWS Directory Service
- AWS Identity and Access Management
- Amazon CloudWatch
- Amazon FSx for Windows File Server

🌍 5 Real-World Examples

  • A bank provisions VPC-isolated WorkSpaces for remote tellers to access internal trading and banking applications with corporate AD authentication, reducing reliance on on-premises desktops.
  • A healthcare provider deploys WorkSpaces for clinicians to access patient applications from hospital rooms and remote sites while keeping data within the VPC and audited via CloudWatch logs.
  • A university offers temporary WorkSpaces to students for lab exercises that require specific pre-installed software, simplifying image distribution and access control.
  • A media studio provides GPU-enabled WorkSpaces to graphic designers so they can render and edit large assets from remote locations without shipping workstations.
  • A government agency issues managed WorkSpaces to contractors with strict directory-based access and centrally managed images to simplify offboarding and compliance.

🎓 AWS Exam Clues

  • Select WorkSpaces when you need centrally managed persistent desktops that integrate with existing directories and VPC networking.
  • WorkSpaces shifts infrastructure management to AWS while customers remain responsible for images, applications, and user data.
  • Consider WorkSpaces bundles and GPU options to match user profiles rather than resizing individual virtual machines.
  • Network design and directory integration are critical—WorkSpaces requires correct VPC, security group, and directory configuration for access.
  • Cost and operational model is per-user desktop; compare with self-managed EC2 desktops when you need full OS-level control.

📝 Quick Revision

Amazon WorkSpaces provides managed, persistent cloud desktops (Windows or Linux) launched into a customer VPC and integrated with directory services. Use it when you need centrally managed user desktops accessible remotely; plan for image and application patching, directory integration, and VPC/network configuration.

🏷 Keywords

cloud desktop • persistent desktop • WorkSpaces bundle • custom image • AWS Directory Service • Amazon VPC • KMS encryption • GPU WorkSpaces • Windows WorkSpaces • Linux WorkSpaces • client application • session management