AWS prescriptive-guidance documentation change
Summary
Updated references from 'Amazon AppStream 2.0' to 'Amazon WorkSpaces Applications' throughout the document, including service name changes in text and image captions, while maintaining the same technical guidance and security controls.
Security assessment
The changes appear to be a rebranding/renaming update from AppStream 2.0 to WorkSpaces Applications without altering security recommendations. Security controls like SAML 2.0 federation, encrypted traffic, and AWS Control Tower guardrails remain unchanged. No vulnerabilities or new security features are mentioned.
Diff
diff --git a/prescriptive-guidance/latest/strategy-education-hybrid-multicloud/virtual-labs.md b/prescriptive-guidance/latest/strategy-education-hybrid-multicloud/virtual-labs.md index 63e174cf6..b64b634e9 100644 --- a//prescriptive-guidance/latest/strategy-education-hybrid-multicloud/virtual-labs.md +++ b//prescriptive-guidance/latest/strategy-education-hybrid-multicloud/virtual-labs.md @@ -9 +9 @@ Despite the popularity of web-based learning tools and the abundance of user dev -In primary and secondary (K12) education, many US schools use [Amazon AppStream 2.0](https://aws.amazon.com/appstream2/), a fully managed desktop and application streaming service, to deliver virtual computer labs to provide access to Adobe Creative Cloud, Autodesk software, STEM and CTE curricula such as Project Lead the Way (PLTW), and more. Many K12 organizations already manage student single sign-on and file storage through Google Workspace and Google Drive, which are SaaS applications. These institutions can set up single sign-on between Google Workspace and AppStream 2.0 through SAML 2.0 federation. They can also configure native integration between AppStream 2.0 and Google Drive so that students can use existing storage. The following diagram illustrates the AppStream 2.0 deployment for this use case. +In primary and secondary (K12) education, many US schools use [Amazon WorkSpaces Applications](https://aws.amazon.com/appstream2/), a fully managed desktop and application streaming service, to deliver virtual computer labs to provide access to Adobe Creative Cloud, Autodesk software, STEM and CTE curricula such as Project Lead the Way (PLTW), and more. Many K12 organizations already manage student single sign-on and file storage through Google Workspace and Google Drive, which are SaaS applications. These institutions can set up single sign-on between Google Workspace and WorkSpaces Applications through SAML 2.0 federation. They can also configure native integration between WorkSpaces Applications and Google Drive so that students can use existing storage. The following diagram illustrates the WorkSpaces Applications deployment for this use case. @@ -11 +11 @@ In primary and secondary (K12) education, many US schools use [Amazon AppStream - + @@ -17 +17 @@ This architecture follows these recommendations: - * **Differentiate between SaaS applications and foundational cloud services.** Google Workspace and Google Drive are not hosted on the same cloud provider as AppStream 2.0, but that is acceptable because this deployment provides the necessary integrations. Single sign-on enables centralized identity management and is securely configured through SAML 2.0. Enabling persistent cloud storage for students requires simple configuration changes in Google Drive and AppStream 2.0. + * **Differentiate between SaaS applications and foundational cloud services.** Google Workspace and Google Drive are not hosted on the same cloud provider as AppStream 2.0, but that is acceptable because this deployment provides the necessary integrations. Single sign-on enables centralized identity management and is securely configured through SAML 2.0. Enabling persistent cloud storage for students requires simple configuration changes in Google Drive and WorkSpaces Applications. @@ -19 +19 @@ This architecture follows these recommendations: - * **Establish security and governance requirements for each cloud service provider.** The services and integrations used in this architecture help meet an institution's security and governance requirements. Streaming traffic is encrypted. Federation through Google Workspace allows for centralized identity management. Network services such as [Amazon Virtual Private Cloud (Amazon VPC)](https://aws.amazon.com/vpc/) support the configuration of subnets, routing, and firewalls. You can filter content by using DNS configuration, agents, virtual appliances, or managed services such as Amazon Route 53 Resolver DNS Firewall. You can use services such as [AWS Control Tower](https://aws.amazon.com/controltower/) to help ensure that the AWS account that hosts AppStream 2.0 adheres to standard organizational guardrails and controls. + * **Establish security and governance requirements for each cloud service provider.** The services and integrations used in this architecture help meet an institution's security and governance requirements. Streaming traffic is encrypted. Federation through Google Workspace allows for centralized identity management. Network services such as [Amazon Virtual Private Cloud (Amazon VPC)](https://aws.amazon.com/vpc/) support the configuration of subnets, routing, and firewalls. You can filter content by using DNS configuration, agents, virtual appliances, or managed services such as Amazon Route 53 Resolver DNS Firewall. You can use services such as [AWS Control Tower](https://aws.amazon.com/controltower/) to help ensure that the AWS account that hosts WorkSpaces Applications adheres to standard organizational guardrails and controls. @@ -21 +21 @@ This architecture follows these recommendations: - * **Adopt cloud-native, managed solutions wherever possible and practical.** AppStream 2.0 is a managed service for desktop and application streaming. You can stream desktops and applications without worrying about provisioning, scaling, or maintaining servers. You install your applications, connect the appropriate identity, network, and storage solutions, and then centrally manage and stream those applications to your users. This eliminates much of the undifferentiated heavy lifting that would be required to manage your own virtual desktop streaming solution. + * **Adopt cloud-native, managed solutions wherever possible and practical.** WorkSpaces Applications is a managed service for desktop and application streaming. You can stream desktops and applications without worrying about provisioning, scaling, or maintaining servers. You install your applications, connect the appropriate identity, network, and storage solutions, and then centrally manage and stream those applications to your users. This eliminates much of the undifferentiated heavy lifting that would be required to manage your own virtual desktop streaming solution.