AWS workspaces medium security documentation change
Summary
Updated drive restrictions and added Credential Guard/Memory Integrity guidance
Security assessment
Provides security configuration guidance regarding Credential Guard and Memory Integrity features that impact system security posture.
Diff
diff --git a/workspaces/latest/adminguide/windows_images_run_byol_checker_script.md b/workspaces/latest/adminguide/windows_images_run_byol_checker_script.md index 10d75ca8f..e7d8a34be 100644 --- a//workspaces/latest/adminguide/windows_images_run_byol_checker_script.md +++ b//workspaces/latest/adminguide/windows_images_run_byol_checker_script.md @@ -122 +122 @@ Local disk must have enough space and requires you to free up 20 GB or more. -Only the C and D drives can be present on a WorkSpace that's used for importing an image. Remove all other drives, including virtual drives. +Only the C drive can be present on an Amazon Machine Image that is being used for importing BYOL WorkSpace Image. Remove all other drives, including virtual drives. @@ -233,0 +234,6 @@ If reserved storage is in use, it might not be disabled, and the following error +The `D:` Drive is a restricted drive letter for WorkSpaces. Please ensure that `D:` is not being used or will not be mapped to during launch of an instance from the image. + +The image being imported is not supported by the streaming protocol chosen, see [ Create a BYOL image using the WorkSpaces console](https://docs.aws.amazon.com/workspaces/latest/adminguide/windows_images_create_byol_image_console.html). + +Memory Integrity is not supported when Credential Guard is enabled on the Windows operating system of a WorkSpace. Memory Integrity was detected with UEFILock which cannot be disabled during image import. Please import an image with UEFILock disabled, see [Disable Credential Guard](https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure?tabs=intune#disable-credential-guard). +