AWS workspaces documentation change
Summary
Added documentation about cross-Region IAM Identity Center integration for WorkSpaces, including setup instructions, limitations, and latency considerations
Security assessment
The changes focus on adding functionality for cross-region integration between WorkSpaces and IAM Identity Center, which is a feature enhancement rather than a security fix or security-related documentation
Diff
diff --git a/workspaces/latest/adminguide/launch-entra-id.md index 279e5e75c..f265c6390 100644 --- a/workspaces/latest/adminguide/launch-entra-id.md +++ b/workspaces/latest/adminguide/launch-entra-id.md @@ -5 +5 @@ -OverviewRequirements and limitationsStep 1: Enable IAM Identity Center and synchronize with Microsoft Entra IDStep 2: Register a Microsoft Entra ID application to grant permissions for Windows AutopilotStep 3: Configure Windows Autopilot user-driven modeStep 4: Create an AWS Secrets Manager secretStep 5: Create a dedicated Microsoft Entra ID WorkSpaces directoryConfigure the IAM Identity Center application for a WorkSpaces directory (optional) +OverviewRequirements and limitationsStep 1: Enable IAM Identity Center and synchronize with Microsoft Entra IDStep 2: Register a Microsoft Entra ID application to grant permissions for Windows AutopilotStep 3: Configure Windows Autopilot user-driven modeStep 4: Create an AWS Secrets Manager secretStep 5: Create a dedicated Microsoft Entra ID WorkSpaces directoryConfigure the IAM Identity Center application for a WorkSpaces directory (optional) Create a cross-Region IAM Identity Center integration (optional) @@ -24,0 +25 @@ Microsoft Entra joined personal WorkSpaces are available in all AWS regions wher + * [ Create a cross-Region IAM Identity Center integration (optional)](./launch-entra-id.html#create-cross-region-iam-identity-integration) @@ -68,0 +70,2 @@ To create Microsoft Entra ID-joined personal WorkSpaces and assign them to your +If you don’t have an existing IAM Identity Center instance to integrate with your WorkSpaces, we recommend that you create one in the same Region as your WorkSpaces. If you have an existing AWS Identity Center instance in a different Region, you can set up cross-Region integration. For more information about cross-Region setup, see Create a cross-Region IAM Identity Center integration (optional). + @@ -71 +74 @@ To create Microsoft Entra ID-joined personal WorkSpaces and assign them to your -A WorkSpaces Personal directory and its associated IAM Identity Center instance must be in the same AWS region. +Cross-region integration between WorkSpaces and IAM Identity Center is not supported in AWS GovCloud (US) Region. @@ -262 +265 @@ Create a dedicated WorkSpaces directory that stores information for your Microso - 4. For **Microsoft Entra tenant ID** , enter your Microsoft Entra ID tenant ID that you want your directory's WorkSpace to join to. You won't be able to change the tenant ID after the directory is created. + 4. For **Microsoft Entra tenant ID** , enter your Microsoft Entra ID tenant ID that you want your directory's WorkSpaces to join to. You won't be able to change the tenant ID after the directory is created. @@ -266 +269,7 @@ Create a dedicated WorkSpaces directory that stores information for your Microso - 6. For **User identity source** , select the IAM Identity Center instance that you configured in [Step 1](https://docs.aws.amazon.com/workspaces/latest/adminguide/launch-workspaces-tutorials.html#entra-step-1)from the drop down list. You won't be able to change the IAM Identity Center instance associated with the directory after the directory is created. + 6. If your IAM Identity Center instance is in the same AWS Region as your WorkSpaces directory, for **User identity source** , select the IAM Identity Center instance that you configured in [Step 1](https://docs.aws.amazon.com/workspaces/latest/adminguide/launch-workspaces-tutorials.html#entra-step-1) from the dropdown list. You won't be able to change the IAM Identity Center instance associated with the directory after the directory is created. + +If your IAM Identity Center instance is in a different AWS Region than your WorkSpaces directory, choose **Enable Cross-Region** and then select the Region from the dropdown list. + +###### Note + +If you have an existing IAM Identity Center instance in a different Region, you must opt-in to set up a cross-Region integration. For more information about cross-Region setup, see Create a cross-Region IAM Identity Center integration (optional). @@ -323,0 +333,22 @@ After you make this change, users in the Identity Center instance will lose acce +## Create a cross-Region IAM Identity Center integration (optional) + +We recommend that your WorkSpaces and the associated IAM Identity Center instance are in the same AWS Region. However, if you already have an IAM Identity Center instance configured in a different Region from your WorkSpaces Region, you can create a cross-Region integration. When you create a cross-Region WorkSpaces and IAM Identity Center integration, you enable WorkSpaces to make cross-Region calls to access and store information from your IAM Identity Center instance, such as user and group attributes. + +###### Important + +Amazon WorkSpaces supports cross-Region IAM Identity Center and WorkSpaces integrations only for organization-level instances. WorkSpaces doesn't support cross-Region IAM Identity Center integrations for account-level instances. For more information about IAM Identity Center instance types and their use cases, see, [Understanding types of IAM Identity Center instances](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/setting-up.html#idc-instance-types). + +If you create a cross-Region integration between a WorkSpaces directory and an IAM Identity Center instance, you may experience higher latency when deploying WorkSpaces and during login because of cross-Region calls. The increase in latency is proportional to the distance between your WorkSpaces Region and the IAM Identity Center Region. We recommend that you perform latency tests for your specific use case. + +Before you can create a cross-Region IAM Identity Center integration, you must complete an opt-in process to allow your AWS accounts to use this feature. To get started, contact your AWS account manager, sales representative, or [AWS Support Center](https://console.aws.amazon.com/support/home#/). Until you complete this process, the Enable cross-Region IAM Identity Center Support option isn't available in your Amazon WorkSpaces console when you create a WorkSpaces directory. + +###### Note + +This opt-in process requires a minimum of one business day to complete. + +After you opt in, you can enable cross-Region IAM Identity Center connections during [Step 5: Create a dedicated Microsoft Entra ID WorkSpaces directory](https://docs.aws.amazon.com/workspaces/latest/adminguide/launch-entra-id.html#entra-step-5). For **User identity source** , choose the IAM Identity Center instance that you configured in Step 1: Enable IAM Identity Center and synchronize with Microsoft Entra ID from the dropdown menu. + +###### Important + +You can't change the IAM Identity Center instance associated with the directory after you create it. +