AWS appstream2 documentation change
Summary
Updated service name references from 'AppStream 2.0' to 'WorkSpaces Applications' throughout the troubleshooting guide
Security assessment
The changes involve rebranding/renaming of the service (AppStream 2.0 to WorkSpaces Applications) but do not introduce new security content, modify security configurations, or address specific vulnerabilities. The troubleshooting scenarios remain functionally identical with updated terminology.
Diff
diff --git a/appstream2/latest/developerguide/troubleshooting-general.md b/appstream2/latest/developerguide/troubleshooting-general.md index 89f7b7271..ba331b555 100644 --- a//appstream2/latest/developerguide/troubleshooting-general.md +++ b//appstream2/latest/developerguide/troubleshooting-general.md @@ -3 +3 @@ -[Documentation](/index.html)[Amazon AppStream 2.0](/appstream2/index.html)[Administration Guide](what-is-appstream.html) +[Documentation](/index.html)[Amazon WorkSpaces Applications](/appstream2/index.html)[Administration Guide](what-is-appstream.html) @@ -5 +5 @@ -SAML federation is not working. The user is not authorized to view AppStream 2.0 applications.After federating from an ADFS portal, my streaming session doesn't start. I am getting the error "Sorry connection went down".I get an invalid redirect URI error.My image builders and fleets never reach the running state. My DNS servers are in a Simple AD directory.I've enabled application settings persistence for my users, but their persistent application settings aren't being saved or loaded.I've enabled application settings persistence for my users, but for certain streaming applications, my users’ passwords aren’t persisting across sessions.Google Chrome data is filling the VHD file that contains my users' persistent application settings. This is preventing their settings from persisting. How can I manage the Chrome profile?I set up a custom domain for my embedded AppStream 2.0 streaming sessions, but my AppStream 2.0 streaming URLs aren't redirecting to my custom domain.I launched an app on a smartcard-enabled AppStream 2.0 fleet, and there are a limited number of certificates (or none) available to the app for authentication.The Certification Propagation service isn't starting on my smartcard-enabled AppStream 2.0 fleet.I can't log in with my Active Directory username or password after SAML authentication. +SAML federation is not working. The user is not authorized to view WorkSpaces Applications applications.After federating from an ADFS portal, my streaming session doesn't start. I am getting the error "Sorry connection went down".I get an invalid redirect URI error.My image builders and fleets never reach the running state. My DNS servers are in a Simple AD directory.I've enabled application settings persistence for my users, but their persistent application settings aren't being saved or loaded.I've enabled application settings persistence for my users, but for certain streaming applications, my users’ passwords aren’t persisting across sessions.Google Chrome data is filling the VHD file that contains my users' persistent application settings. This is preventing their settings from persisting. How can I manage the Chrome profile?I set up a custom domain for my embedded WorkSpaces Applications streaming sessions, but my WorkSpaces Applications streaming URLs aren't redirecting to my custom domain.I launched an app on a smartcard-enabled WorkSpaces Applications fleet, and there are a limited number of certificates (or none) available to the app for authentication.The Certification Propagation service isn't starting on my smartcard-enabled WorkSpaces Applications fleet.I can't log in with my Active Directory username or password after SAML authentication. @@ -9 +9 @@ SAML federation is not working. The user is not authorized to view AppStream 2.0 -The following are general issues that might occur when you use Amazon AppStream 2.0. +The following are general issues that might occur when you use Amazon WorkSpaces Applications. @@ -13 +13 @@ The following are general issues that might occur when you use Amazon AppStream - * SAML federation is not working. The user is not authorized to view AppStream 2.0 applications. + * SAML federation is not working. The user is not authorized to view WorkSpaces Applications applications. @@ -27 +27 @@ The following are general issues that might occur when you use Amazon AppStream - * I set up a custom domain for my embedded AppStream 2.0 streaming sessions, but my AppStream 2.0 streaming URLs aren't redirecting to my custom domain. + * I set up a custom domain for my embedded WorkSpaces Applications streaming sessions, but my WorkSpaces Applications streaming URLs aren't redirecting to my custom domain. @@ -29 +29 @@ The following are general issues that might occur when you use Amazon AppStream - * I launched an app on a smartcard-enabled AppStream 2.0 fleet, and there are a limited number of certificates (or none) available to the app for authentication. + * I launched an app on a smartcard-enabled WorkSpaces Applications fleet, and there are a limited number of certificates (or none) available to the app for authentication. @@ -31 +31 @@ The following are general issues that might occur when you use Amazon AppStream - * The Certification Propagation service isn't starting on my smartcard-enabled AppStream 2.0 fleet. + * The Certification Propagation service isn't starting on my smartcard-enabled WorkSpaces Applications fleet. @@ -38 +38 @@ The following are general issues that might occur when you use Amazon AppStream -## SAML federation is not working. The user is not authorized to view AppStream 2.0 applications. +## SAML federation is not working. The user is not authorized to view WorkSpaces Applications applications. @@ -40 +40 @@ The following are general issues that might occur when you use Amazon AppStream -This might happen because the inline policy that is embedded for the SAML 2.0 federation IAM role does not include permissions to the stack ARN. The IAM role is assumed by the federated user who is accessing an AppStream 2.0 stack. Edit the role permissions to include the stack ARN. For more information, see [Amazon AppStream 2.0 Integration with SAML 2.0](./external-identity-providers.html) and [Troubleshooting SAML 2.0 Federation with AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_saml.html) in the _IAM User Guide_. +This might happen because the inline policy that is embedded for the SAML 2.0 federation IAM role does not include permissions to the stack ARN. The IAM role is assumed by the federated user who is accessing an WorkSpaces Applications stack. Edit the role permissions to include the stack ARN. For more information, see [Amazon WorkSpaces Applications Integration with SAML 2.0](./external-identity-providers.html) and [Troubleshooting SAML 2.0 Federation with AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_saml.html) in the _IAM User Guide_. @@ -48 +48 @@ Set the claim rule's **Incoming Claim Type** for the **NameID** SAML attribute t -This error occurs due to a malformed or invalid AppStream 2.0 stack relay state URL. Make sure that the relay state configured in your federation setup is the same as the stack relay state that is displayed in the stack details through the AppStream 2.0 console. If they are the same and the problem still persists, contact AWS Support. For more information, see [Amazon AppStream 2.0 Integration with SAML 2.0](./external-identity-providers.html). +This error occurs due to a malformed or invalid WorkSpaces Applications stack relay state URL. Make sure that the relay state configured in your federation setup is the same as the stack relay state that is displayed in the stack details through the WorkSpaces Applications console. If they are the same and the problem still persists, contact AWS Support. For more information, see [Amazon WorkSpaces Applications Integration with SAML 2.0](./external-identity-providers.html). @@ -52 +52 @@ This error occurs due to a malformed or invalid AppStream 2.0 stack relay state -AppStream 2.0 relies on the DNS servers within your VPC to return a non-existent domain (NXDOMAIN) response for local domain names that don’t exist. This enables the AppStream 2.0-managed network interface to communicate with the management servers. +WorkSpaces Applications relies on the DNS servers within your VPC to return a non-existent domain (NXDOMAIN) response for local domain names that don’t exist. This enables the WorkSpaces Applications-managed network interface to communicate with the management servers. @@ -54 +54 @@ AppStream 2.0 relies on the DNS servers within your VPC to return a non-existent -When you create a directory with Simple AD, AWS Directory Service creates two domain controllers that also function as DNS servers on your behalf. Because the domain controllers don't provide the NXDOMAIN response, they can't be used with AppStream 2.0. +When you create a directory with Simple AD, AWS Directory Service creates two domain controllers that also function as DNS servers on your behalf. Because the domain controllers don't provide the NXDOMAIN response, they can't be used with WorkSpaces Applications. @@ -58 +58 @@ When you create a directory with Simple AD, AWS Directory Service creates two do -AppStream 2.0 automatically saves application settings that are created in certain locations on the Windows instance. The settings are saved only if your application saves them to one of these locations. For a list of supported locations, see [How Application Settings Persistence Works](./how-it-works-app-settings-persistence.html). If your application is configured to save to C:\Users\%username% and your users' settings for the application aren’t persisting between sessions, the mount point might not be created. This prevents the settings from being saved to the VHD file that contains your users’ persistent application settings. +WorkSpaces Applications automatically saves application settings that are created in certain locations on the Windows instance. The settings are saved only if your application saves them to one of these locations. For a list of supported locations, see [How Application Settings Persistence Works](./how-it-works-app-settings-persistence.html). If your application is configured to save to C:\Users\%username% and your users' settings for the application aren’t persisting between sessions, the mount point might not be created. This prevents the settings from being saved to the VHD file that contains your users’ persistent application settings. @@ -96 +96 @@ By default, Google Chrome stores both user data and the local disk cache in the -Running Chrome with these parameters prevents the disk cache from being persisted between AppStream 2.0 sessions. +Running Chrome with these parameters prevents the disk cache from being persisted between WorkSpaces Applications sessions. @@ -98 +98 @@ Running Chrome with these parameters prevents the disk cache from being persiste -## I set up a custom domain for my embedded AppStream 2.0 streaming sessions, but my AppStream 2.0 streaming URLs aren't redirecting to my custom domain. +## I set up a custom domain for my embedded WorkSpaces Applications streaming sessions, but my WorkSpaces Applications streaming URLs aren't redirecting to my custom domain. @@ -100 +100 @@ Running Chrome with these parameters prevents the disk cache from being persiste -To resolve this issue, verify that when you created your AppStream 2.0 streaming URL, you replaced the AppStream 2.0 endpoint with your custom domain. By default, AppStream 2.0 streaming URLs are formatted as follows: +To resolve this issue, verify that when you created your WorkSpaces Applications streaming URL, you replaced the WorkSpaces Applications endpoint with your custom domain. By default, WorkSpaces Applications streaming URLs are formatted as follows: @@ -105 +105 @@ To resolve this issue, verify that when you created your AppStream 2.0 streaming -To replace the default AppStream 2.0 endpoint in your streaming URL, replace `https://appstream2.``region` in the URL with your custom domain. For example, if your custom domain is `training.example.com`, your new streaming URL must follow this format: +To replace the default WorkSpaces Applications endpoint in your streaming URL, replace `https://appstream2.``region` in the URL with your custom domain. For example, if your custom domain is `training.example.com`, your new streaming URL must follow this format: @@ -110 +110 @@ To replace the default AppStream 2.0 endpoint in your streaming URL, replace `ht -For more information about configuring custom domains for embedded AppStream 2.0 streaming sessions, see [Configuration Requirements for Using Custom Domains](./create-streaming-url-user-authentication.html#configuration-requirements-custom-domains). +For more information about configuring custom domains for embedded WorkSpaces Applications streaming sessions, see [Configuration Requirements for Using Custom Domains](./create-streaming-url-user-authentication.html#configuration-requirements-custom-domains). @@ -112 +112 @@ For more information about configuring custom domains for embedded AppStream 2.0 -## I launched an app on a smartcard-enabled AppStream 2.0 fleet, and there are a limited number of certificates (or none) available to the app for authentication. +## I launched an app on a smartcard-enabled WorkSpaces Applications fleet, and there are a limited number of certificates (or none) available to the app for authentication. @@ -165 +165 @@ For example, the following script won't launch the application until the Certifi -## The Certification Propagation service isn't starting on my smartcard-enabled AppStream 2.0 fleet. +## The Certification Propagation service isn't starting on my smartcard-enabled WorkSpaces Applications fleet. @@ -167 +167 @@ For example, the following script won't launch the application until the Certifi -If the [Certificate Propagation](https://docs.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service) service isn't starting, the service’s startup type might be set to **Disabled**. To resolve this, on the AppStream 2.0 image builder used to create your fleet’s image, launch the Windows Services Microsoft Management Console, and make sure that the startup type of the Certificate Propagation service isn't set to **Disabled**. +If the [Certificate Propagation](https://docs.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service) service isn't starting, the service’s startup type might be set to **Disabled**. To resolve this, on the WorkSpaces Applications image builder used to create your fleet’s image, launch the Windows Services Microsoft Management Console, and make sure that the startup type of the Certificate Propagation service isn't set to **Disabled**. @@ -169 +169 @@ If the [Certificate Propagation](https://docs.microsoft.com/en-us/windows/securi -If the startup type isn't set to **Disabled** , and the service is still not starting on your AppStream 2.0 fleet, use the PowerShell module [Start-Service](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-service?view=powershell-7.1) to start the Certificate Propagation service when your fleet instance starts. +If the startup type isn't set to **Disabled** , and the service is still not starting on your WorkSpaces Applications fleet, use the PowerShell module [Start-Service](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-service?view=powershell-7.1) to start the Certificate Propagation service when your fleet instance starts.