AWS workspaces documentation change
Summary
Restructured document by removing detailed security implementation sections and replacing with a table of contents linking to dedicated pages for each security aspect. Removed technical content about VPC endpoint configuration, network isolation details, and authorization methods.
Security assessment
The changes reorganize existing security documentation rather than addressing specific vulnerabilities or adding new security features. While the removed content included security-related configurations, the modification appears to be structural/architectural rather than a direct response to security issues. No evidence of vulnerability fixes or new security capabilities being documented.
Diff
diff --git a/workspaces/latest/adminguide/infrastructure-security.md b/workspaces/latest/adminguide/infrastructure-security.md index 179751c44..b865d72f9 100644 --- a//workspaces/latest/adminguide/infrastructure-security.md +++ b//workspaces/latest/adminguide/infrastructure-security.md @@ -5,2 +4,0 @@ -Network isolationIsolation on physical hostsAuthorization of corporate usersMake Amazon WorkSpaces API requests through a VPC interface endpointCreate a VPC endpoint policy for Amazon WorkSpacesConnect your private network to your VPC - @@ -22,89 +20 @@ Additionally, requests must be signed by using an access key ID and a secret acc -## Network isolation - -A virtual private cloud (VPC) is a virtual network in your own logically isolated area in the AWS Cloud. You can deploy your WorkSpaces in a private subnet in your VPC. For more information, see [Configure a VPC for WorkSpaces Personal](./amazon-workspaces-vpc.html). - -To allow traffic only from specific address ranges (for example, from your corporate network), update the security group for your VPC or use an [IP access control group](./amazon-workspaces-ip-access-control-groups.html). - -You can restrict WorkSpace access to trusted devices with valid certificates. For more information, see [Restrict access to trusted devices for WorkSpaces Personal](./trusted-devices.html). - -## Isolation on physical hosts - -Different WorkSpaces on the same physical host are isolated from each other through the hypervisor. It is as though they are on separate physical hosts. When a WorkSpace is deleted, the memory allocated to it is scrubbed (set to zero) by the hypervisor before it is allocated to a new WorkSpace. - -## Authorization of corporate users - -With WorkSpaces, directories are managed through the AWS Directory Service. You can create a standalone, managed directory for users. Or you can integrate with your existing Active Directory environment so that your users can use their current credentials to obtain seamless access to corporate resources. For more information, see [Manage directories for WorkSpaces Personal](./manage-workspaces-directory.html). - -To further control access to your WorkSpaces, use multi-factor authentication. For more information, see [How to Enable Multi-Factor Authentication for AWS Services](https://aws.amazon.com/blogs/security/how-to-enable-multi-factor-authentication-for-amazon-workspaces-and-amazon-quicksight-by-using-microsoft-ad-and-on-premises-credentials/). - -## Make Amazon WorkSpaces API requests through a VPC interface endpoint - -You can connect directly to Amazon WorkSpaces API endpoints through an [interface endpoint](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpce-interface.html) in your virtual private cloud (VPC) instead of connecting over the internet. When you use a VPC interface endpoint, communication between your VPC and the Amazon WorkSpaces API endpoint is conducted entirely and securely within the AWS network. - -###### Note - -This feature can be used only for connecting to WorkSpaces API endpoints. To connect to WorkSpaces using the WorkSpaces clients, internet connectivity is required, as described in [IP address and port requirements for WorkSpaces Personal](./workspaces-port-requirements.html). - -The Amazon WorkSpaces API endpoints support [Amazon Virtual Private Cloud](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Introduction.html) (Amazon VPC) interface endpoints that are powered by [AWS PrivateLink](https://aws.amazon.com/privatelink/). Each VPC endpoint is represented by one or more [network interfaces](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html) (also known as elastic network interfaces, or ENIs) with private IP addresses in your VPC subnets. - -The VPC interface endpoint connects your VPC directly to the Amazon WorkSpaces API endpoint without an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. The instances in your VPC don't need public IP addresses to communicate with the Amazon WorkSpaces API endpoint. - -You can create an interface endpoint to connect to Amazon WorkSpaces with either the AWS Management Console or AWS Command Line Interface (AWS CLI) commands. For instructions, see [Creating an Interface Endpoint](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpce-interface.html#create-interface-endpoint). - -_After you have created a VPC endpoint_ , you can use the following example CLI commands that use the `endpoint-url` parameter to specify interface endpoints to the Amazon WorkSpaces API endpoint: - - - aws workspaces copy-workspace-image --endpoint-url VPC_Endpoint_ID.workspaces.Region.vpce.amazonaws.com - - aws workspaces delete-workspace-image --endpoint-url VPC_Endpoint_ID.api.workspaces.Region.vpce.amazonaws.com - - aws workspaces describe-workspace-bundles --endpoint-url VPC_Endpoint_ID.workspaces.Region.vpce.amazonaws.com \ - --endpoint-name Endpoint_Name \ - --body "Endpoint_Body" \ - --content-type "Content_Type" \ - Output_File - -If you enable private DNS hostnames for your VPC endpoint, you don't need to specify the endpoint URL. The Amazon WorkSpaces API DNS hostname that the CLI and Amazon WorkSpaces SDK use by default (https://api.workspaces.`Region`.amazonaws.com) resolves to your VPC endpoint. - -The Amazon WorkSpaces API endpoint supports VPC endpoints in all AWS Regions where both [Amazon VPC](https://docs.aws.amazon.com/general/latest/gr/rande.html#vpc_region) and [Amazon WorkSpaces](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services) are available. Amazon WorkSpaces supports making calls to all of its [public APIs](https://docs.aws.amazon.com/workspaces/latest/api/welcome.html) inside your VPC. - -To learn more about AWS PrivateLink, see the [AWS PrivateLink documentation](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Introduction.html#what-is-privatelink). For the price of VPC endpoints, see [VPC Pricing](https://aws.amazon.com/vpc/pricing/). To learn more about VPC and endpoints, see [Amazon VPC](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html). - -To see a list of Amazon WorkSpaces API endpoints by Region, see [WorkSpaces API Endpoints](./workspaces-port-requirements.html#workspaces_api_endpoints). - -###### Note - -Amazon WorkSpaces API endpoints with AWS PrivateLink are not supported for Federal Information Processing Standard (FIPS) Amazon WorkSpaces API endpoints. - -## Create a VPC endpoint policy for Amazon WorkSpaces - -You can create a policy for Amazon VPC endpoints for Amazon WorkSpaces to specify the following: - - * The principal that can perform actions. - - * The actions that can be performed. - - * The resources on which actions can be performed. - - - - -For more information, see [Controlling Access to Services with VPC Endpoints](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html) in the _Amazon VPC User Guide_. - -###### Note - -VPC endpoint policies aren't supported for Federal Information Processing Standard (FIPS) Amazon WorkSpaces endpoints. - -The following example VPC endpoint policy specifies that all users who have access to the VPC interface endpoint are allowed to invoke the Amazon WorkSpaces hosted endpoint named `ws-f9abcdefg`. - - - { - "Statement": [ - { - "Action": "workspaces:*", - "Effect": "Allow", - "Resource": "arn:aws:workspaces:us-west-2:1234567891011:workspace/ws-f9abcdefg", - "Principal": "*" - } - ] - } +###### Contents @@ -112 +22 @@ The following example VPC endpoint policy specifies that all users who have acce -In this example, the following actions are denied: + * [Network isolation](./network-isolation.html) @@ -114 +24 @@ In this example, the following actions are denied: - * Invoking Amazon WorkSpaces hosted endpoints other than `ws-f9abcdefg`. + * [Isolation on physical hosts](./physical-isolation.html) @@ -116 +26 @@ In this example, the following actions are denied: - * Performing an action on any resource besides the one specified (WorkSpace ID: `ws-f9abcdefg`). + * [Authorization of corporate users](./authorization.html) @@ -117,0 +28 @@ In this example, the following actions are denied: + * [Create and Stream from Interface VPC Endpoints](./creating-streaming-vpc-endpoints.html) @@ -118,0 +30 @@ In this example, the following actions are denied: + * [Make Amazon WorkSpaces API requests through a VPC interface endpoint](./interface-vpc-endpoint.html) @@ -119,0 +32 @@ In this example, the following actions are denied: + * [Create a VPC endpoint policy for Amazon WorkSpaces](./api-private-link-policy.html) @@ -121 +34 @@ In this example, the following actions are denied: -###### Note + * [Connect your private network to your VPC](./notebook-private-link-vpn.html) @@ -123 +35,0 @@ In this example, the following actions are denied: -In this example, users can still take other Amazon WorkSpaces API actions from outside the VPC. To restrict API calls to those from within the VPC, see [Identity and access management for WorkSpaces](./workspaces-access-control.html) for information about using identity-based policies to control access to Amazon WorkSpaces API endpoints. @@ -125 +36,0 @@ In this example, users can still take other Amazon WorkSpaces API actions from o -## Connect your private network to your VPC @@ -127 +37,0 @@ In this example, users can still take other Amazon WorkSpaces API actions from o -To call the Amazon WorkSpaces API through your VPC, you have to connect from an instance that is inside the VPC, or connect your private network to your VPC by using AWS Virtual Private Network (AWS VPN) or AWS Direct Connect. For information, see [VPN Connections](https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.html) in the _Amazon Virtual Private Cloud User Guide_. For information about AWS Direct Connect, see [Creating a Connection](https://docs.aws.amazon.com/directconnect/latest/UserGuide/create-connection.html) in the _AWS Direct Connect User Guide_. @@ -137 +47 @@ Resilience -Update management +Network isolation