AWS workspaces medium security documentation change
Summary
Restructured BYOL documentation with expanded sections on prerequisites, image validation steps, account linking procedures, and WorkSpaces Pool creation. Added detailed instructions for running Image Compatibility Checker script, Windows Defender exclusions, and management interface requirements.
Security assessment
Added requirement to verify Windows security updates are installed before running Image Compatibility Checker script ('verify that the latest Windows security updates are installed on your VM'). This directly addresses potential security vulnerabilities from unpatched systems. Also added Windows Defender exclusion list configuration which relates to security tool configuration.
Diff
diff --git a/workspaces/latest/adminguide/byol-windows-images.md b/workspaces/latest/adminguide/byol-windows-images.md index 1b3bd188a..bd910f95e 100644 --- a//workspaces/latest/adminguide/byol-windows-images.md +++ b//workspaces/latest/adminguide/byol-windows-images.md @@ -5 +5 @@ -Using Amazon EC2 Image Builder (Windows 11 only)Windows versions supported for BYOLVideos on uploading and creating BYOL imagesLink BYOL accounts in WorkSpaces +Using Bring Your Own Windows desktop licenses in WorkSpaces @@ -15 +15 @@ To stay compliant with Microsoft licensing terms, AWS runs your BYOL WorkSpaces -Image creation is not supported on Windows 10 or 11 systems that have been upgraded from one version of Windows 10 or 11 to a newer version of Windows 10 or 11 (a Windows feature/version upgrade). However, Windows cumulative or security updates are supported by the WorkSpaces image-creation process. +Image creation is not supported on Windows 11 systems that have been upgraded from one version of Windows 11 to a newer version of Windows 11 (a Windows feature/version upgrade). For example, a Windows 11 23H2 system which was upgraded to 24H2 cannot be used to create an image. However, Windows cumulative or security updates are supported by the WorkSpaces image-creation process. @@ -17 +17 @@ Image creation is not supported on Windows 10 or 11 systems that have been upgra -## Using Amazon EC2 Image Builder (Windows 11 only) +###### Topics @@ -19 +19 @@ Image creation is not supported on Windows 10 or 11 systems that have been upgra -If you are using Windows 11, you can choose to use Amazon EC2 Image Builder to import and create your BYOL image for WorkSpaces. To do this, you use Amazon EC2 Image Builder in place of: + * Using Bring Your Own Windows desktop licenses in WorkSpaces @@ -21 +21 @@ If you are using Windows 11, you can choose to use Amazon EC2 Image Builder to i - * [Step 4: Confirm that the Windows VM in Amazon WorkSpaces meets the requirements for Microsoft BYOL](./windows_images_run_byol_checker_script.html) + * [Videos on uploading and creating BYOL images](./byol-videos.html) @@ -23 +23 @@ If you are using Windows 11, you can choose to use Amazon EC2 Image Builder to i - * [Step 5: Export a VM from your virtualization environment in Amazon WorkSpaces](./windows_images_create_image_byol.html) + * [Link BYOL accounts in WorkSpaces](./link-byol-account.html) @@ -24,0 +25 @@ If you are using Windows 11, you can choose to use Amazon EC2 Image Builder to i + * [Common error messages and their solutions](./windows-images-common-errors.html) @@ -25,0 +27 @@ If you are using Windows 11, you can choose to use Amazon EC2 Image Builder to i + * [List of SysPrep error messages and error fixes](./images-errors-sysprep.html) @@ -28 +29,0 @@ If you are using Windows 11, you can choose to use Amazon EC2 Image Builder to i -For more information, see [_Amazon EC2 Image Builder User Guide_](https://docs.aws.amazon.com/imagebuilder/latest/userguide/what-is-image-builder.html). @@ -30 +31,51 @@ For more information, see [_Amazon EC2 Image Builder User Guide_](https://docs.a -## Windows versions supported for BYOL + +## Using Bring Your Own Windows desktop licenses in WorkSpaces + +Use the following steps to import and use your own Windows desktop license in Amazon WorkSpaces + +Before you begin, verify the following: + + * Your Microsoft licensing agreement allows Windows to run in a virtual hosted environment. + + * If you will be using non-GPU-enabled bundles (bundles other than Graphics.g4dn, GraphicsPro.g4dn, Graphics, and GraphicsPro), verify that you will use a minimum of 50 WorkSpaces per Region. These 50 WorkSpaces can be any mix of AlwaysOn and AutoStop WorkSpaces. Using a minimum of 50 WorkSpaces per Region is a requirement for running your WorkSpaces on dedicated hardware. Running your WorkSpaces on dedicated hardware is necessary to comply with Microsoft licensing requirements. The dedicated hardware is provisioned on the AWS side, so your VPC can stay on default tenancy. + +If you plan to use GPU-enabled (Graphics.g4dn, GraphicsPro.g4dn, Graphics, and GraphicsPro) bundles, verify that you will run a minimum of 4 AlwaysOn or 20 AutoStop GPU-enabled WorkSpaces in a Region per month on dedicated hardware. + +###### Note + + * As part of the image import process, AWS automatically retrieves system logs to resolve image import errors, provide troubleshooting help, and provide accurate error messages to users. + + * Graphics.g4dn, GraphicsPro.g4dn, Graphics, and GraphicsPro bundles are not available in the Africa (Cape Town) Region and the Israel (Tel Aviv) Region. + + * To run your WorkSpaces in the Africa (Cape Town) Region, you are required to run a minimum of 400 WorkSpaces in the Africa (Cape Town) Region. + + * Value bundles are not available for Windows 11 and WorkSpaces Pools. For more information about migrating your existing value bundle WorkSpaces see [Migrate a WorkSpace in WorkSpaces Personal](./migrate-workspaces.html). + + * For the best video conferencing experience we recommend using Power (4 vCPU, 16 GB memory or higher) bundles. + + * WorkSpaces can use a management interface in the /16 IP address range. The management interface is connected to a secure WorkSpaces management network used for interactive streaming. This allows WorkSpaces to manage your WorkSpaces. For more information, see [Network interfaces](./workspaces-port-requirements.html#network-interfaces). You must reserve a /16 netmask from at least one of the following IP address ranges for this purpose: + + * 10.0.0.0/8 + + * 100.64.0.0/10 + + * 172.16.0.0/12 + + * 192.168.0.0/16 + + * 198.18.0.0/15 + +###### Note + + * As you adopt the WorkSpaces service, the available management interface IP address ranges frequently change. To determine which ranges are currently available, run the [ list-available-management-cidr-ranges](https://docs.aws.amazon.com/cli/latest/reference/workspaces/list-available-management-cidr-ranges.html) AWS Command Line Interface (AWS CLI) command. + + * In addition to the /16 CIDR block that you select, the 54.239.224.0/20 IP address range is used for management interface traffic in all AWS Regions. + + * Before importing a BYOL customized virtual machine image, validate your image. + +WorkSpaces only supports images with UEFI boot mode enabled. For more information on how EC2 Image Builder detects the boot mode, see [Volume types and file systems supported by VM Import/Export ](https://docs.aws.amazon.com/vm-import/latest/userguide/prerequisites.html#vmimport-volume-types:~:text=Linux/Unix-,Windows,-GUID%20Partition%20Table) in the _VM Import/Export User Guide_. + + + + +#### Windows versions supported for BYOL @@ -53 +104,114 @@ Windows 10 N and Windows 11 N versions are not supported for BYOL at this time. -## Videos on uploading and creating BYOL images +After you have confirmed that you meet the prerequisites for using Windows BYOL with WorkSpaces, you need to enable your account to use BYOL images. + + 1. In the WorkSpaces Console, navigate to the Account Settings page. + + 2. In the Bring Your Own License (BYOL) section, your account’s BYOL enablement status is shown. If the status shows that your account is not enabled, choose the **Get Started with BYOL** button. + + 3. On the BYOL page, choose Enable account for BYOL. + +###### Note + +Enabling your account for BYOL only applies to a single region. Take note of which region you are currently in, and if you wish to use a different region, switch to that region before enabling your account. + + 4. A popup modal appears confirming that you understand the minimum requirements to use BYOL WorkSpaces. Confirm your understanding of the requirements and choose Enable account. + +###### Note + +If you plan to use Graphics WorkSpaces with BYOL, create an AWS Support ticket. Graphics BYOL enablement is not yet supported through the WorkSpaces Console. + + 5. In most cases, accounts are automatically enabled. However, some accounts require additional review. The enablement status is shown on the BYOL page once refreshed. + + 6. When your account is enabled for BYOL, proceed to the next step. + + + + +###### Note + +This step only applies to custom VM images that are going to be imported. If you are importing a Windows ISO, you can skip this step. + +If you are importing a customized virtual machine image, we recommend you run the WorkSpaces Image Checker tool to ensure your VM is compatible with WorkSpaces. The Image Checker tool runs a series of tests and can help fix compatibility issues. + +###### To download the Image Compatibility Checker script + +Before you download and run the Image Compatibility Checker script, verify that the latest Windows security updates are installed on your VM. While this script runs, it disables the Windows Update service. + + 1. Download the Image Compatibility Checker script .zip file from [ImageCompatibilityChecker.zip](https://tools.amazonworkspaces.com/ImageCompatibilityChecker.zip) to your `Downloads` folder. + + 2. In your `Downloads` folder, create a `BYOL` folder. + + 3. Extract the files from `ImageCompatibilityChecker.zip` and copy them to the `Downloads\BYOL` folder. + + 4. Delete the `Downloads\ImageCompatibilityChecker.zip` folder so that only the extracted files remain. + + + + +Perform these steps to run the Image Compatibility Checker script. + +###### To run the Image Compatibility Checker script + + 1. Open Powershell as administrator. + + 1. Select the Windows Start button. + + 2. Right-click **Windows PowerShell**. + + 3. Choose **Run as administrator**. + + 4. If prompted by User Account Control, choose **Yes**. + + 2. At the PowerShell command prompt, change to the directory where the Image Compatibility Checker script is located. For example, if the script is located in the `Downloads\BYOL` directory, enter the following command and press **Enter** : + +`cd C:\Users\`username`\Downloads\BYOL` + + 3. Enter the following command to update the PowerShell execution policy on the computer. Doing so allows the Image Compatibility Checker script to run: + +`Set-ExecutionPolicy AllSigned` + + 4. When prompted to confirm whether to change the PowerShell execution policy, enter **A** to specify Yes to All. + + 5. Enter the following command to run the Image Compatibility Checker script: + +`.\ImageCompatibilityChecker.ps1` + + 6. If a security notification appears, press the **R** key to Run Once. + + 7. In the **WorkSpaces Image Validation** dialog box, choose **Run Tests**. + + 8. After each test is completed, you can view the status of the test. For any test with a status of **FAILED** , choose **Info** to display information about how to resolve the issue that caused the failure. If any tests display a status of **WARNING** , choose the **Fix All Warnings** button. + + 9. If applicable, resolve any issues that cause test failures and warnings, and repeat Step 7 and Step 8 until the VM passes all tests. All failures and warnings must be resolved before you export the VM. + + 10. The BYOL script checker generates two log files, `WorkSpacesImageCompatabilityCheckLog`YYYY-MM-DD_HHmmss`.txt` and `ImageInfo.text`. These files are located in the directory that contains the Image Compatibility Checker script files. + +###### Tip + +Do not delete these files. If an issue occurs, they might be helpful in troubleshooting. + + 11. After your VM passes all tests, you get a **Validation Successful** message. + +You will also see a prompt to run Sysprep. Close the prompt and don't run Sysprep yet. + + 12. Shut down the VM and export it. For more information, see [Export your VM from its virtualization environment](https://docs.aws.amazon.com/vm-import/latest/userguide/export-vm-image.html) in the VM Import/Export User Guide. + + 13. (Optional) Start the VM and run the Image Compatibility Checker script one more time. All validations should pass. A screen will pop up again with a button to run Sysprep. Choose **Run Sysprep**. If Sysprep is successful, your exported VM that you exported from step 12 can be imported into Amazon Elastic Compute Cloud (Amazon EC2). + +If Sysprep is unsuccessful, review the Sysprep logs in the `%WINDIR%\System32\Sysprep\Panther` path, roll back to the exported VM from step 12, resolve the reported issues, and complete step 12 again by exporting the fixed VM. You will then re-run the Image Compatibility Checker script to ensure the issues have been resolved. + +The most common reason for a Sysprep failure is that the Modern AppX Packages have not been uninstalled for all users. Use the `Remove-AppxPackage` PowerShell cmdlet to remove the AppX Packages. + + 14. Import the VM that you exported in step 12 into Amazon EC2. + + + + +Perform these steps to import your image and create a WorkSpaces BYOL image: + + 1. Go to the navigation pane and choose **Images** , then **Import Image**. + + 2. Follow the steps on the **Import Image** page based on the base image option and type of image you want to import: + + * **VM import** – Imports a virtual machine image that has already been customized. You can import a `VHDX`, `VMDK`, or `OVF` file. + + * **ISO import** – Imports a Windows ISO image that you downloaded from Microsoft and has not been customized. @@ -55 +219 @@ Windows 10 N and Windows 11 N versions are not supported for BYOL at this time. -For a demonstration on uploading BYOL images, watch the following videos. + * **AMI import** – Imports an existing Amazon EC2 AMI to use as your WorkSpaces BYOL image.