AWS prescriptive-guidance documentation change
Summary
Added 'Best practices' and 'Troubleshooting' sections, updated prerequisites, architecture details, and epic steps. Enhanced links and terminology for clarity.
Security assessment
The changes add security best practices documentation (network configuration, testing procedures) but don't reference any specific vulnerability or incident. Security improvements are preventive guidance rather than addressing known issues.
Diff
diff --git a/prescriptive-guidance/latest/patterns/automate-the-creation-of-appstream-2-0-resources-using-aws-cloudformation.md b/prescriptive-guidance/latest/patterns/automate-the-creation-of-appstream-2-0-resources-using-aws-cloudformation.md index e6cdf39b3..f18e48eb6 100644 --- a//prescriptive-guidance/latest/patterns/automate-the-creation-of-appstream-2-0-resources-using-aws-cloudformation.md +++ b//prescriptive-guidance/latest/patterns/automate-the-creation-of-appstream-2-0-resources-using-aws-cloudformation.md @@ -5 +5 @@ -SummaryPrerequisites and limitationsArchitectureToolsEpicsRelated resourcesAdditional information +SummaryPrerequisites and limitationsArchitectureToolsBest practicesEpicsTroubleshootingRelated resourcesAdditional information @@ -13 +13 @@ SummaryPrerequisites and limitationsArchitectureToolsEpicsRelated resourcesAddit -This pattern provides code samples and steps to automate the creation of Amazon WorkSpaces Applications resources in the Amazon Web Services (AWS) Cloud by using an AWS CloudFormation template. The pattern shows you how to use a CloudFormation stack to automate the creation of your WorkSpaces Applications application resources, including an image builder, image, fleet instance, and stack. You can stream your WorkSpaces Applications application to end users on an HTML5-compliant browser by using either the desktop or application delivery mode. +This pattern provides code samples and steps to automate the creation of [Amazon WorkSpaces Applications](https://aws.amazon.com/workspaces/applications/) resources in the AWS Cloud by using an [AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html) template. The pattern shows you how to use a CloudFormation stack to automate the creation of your WorkSpaces Applications application resources, including an image builder, image, fleet instance, and stack. You can stream your WorkSpaces Applications application to end users on an HTML5-compliant browser by using either the desktop or application delivery mode. @@ -23 +23 @@ This pattern provides code samples and steps to automate the creation of Amazon - * Basic knowledge of WorkSpaces Applications resources, such as [stacks](https://docs.aws.amazon.com/appstream2/latest/developerguide/managing-stacks-fleets.html), [fleets](https://docs.aws.amazon.com/appstream2/latest/developerguide/managing-stacks-fleets.html), and [image builders](https://docs.aws.amazon.com/appstream2/latest/developerguide/managing-image-builders.html) + * Basic knowledge of WorkSpaces Applications resources, such as [fleets and stacks](https://docs.aws.amazon.com/appstream2/latest/developerguide/managing-stacks-fleets.html) and [image builders](https://docs.aws.amazon.com/appstream2/latest/developerguide/managing-image-builders.html) @@ -30 +30 @@ This pattern provides code samples and steps to automate the creation of Amazon - * You can’t modify the AWS Identity and Access Management (IAM) role associated with an WorkSpaces Applications instance after that instance is created. + * You can’t modify the [AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html) (IAM) role associated with an WorkSpaces Applications instance after that instance is created. @@ -32 +32 @@ This pattern provides code samples and steps to automate the creation of Amazon - * You can’t modify properties (such as the subnet or security group) on the WorkSpaces Applications image builder instance after that image builder is created. + * You can’t modify properties (such as the [subnet](https://docs.aws.amazon.com/vpc/latest/userguide/configure-subnets.html#subnet-basics) or [security group](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html)) on the WorkSpaces Applications image builder instance after that image builder is created. @@ -39 +39 @@ This pattern provides code samples and steps to automate the creation of Amazon -The following diagram shows you how to automate the creation of WorkSpaces Applications resources by using an CloudFormation template. +The following diagram shows you how to automate the creation of WorkSpaces Applications resources by using a CloudFormation template. @@ -64 +64,17 @@ The diagram shows the following workflow: - * [AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html) helps you model and set up your AWS resources, provision them quickly and consistently, and manage them throughout their lifecycle. You can use a template to describe your resources and their dependencies, and launch and configure them together as a stack, instead of managing resources individually. You can manage and provision stacks across multiple AWS accounts and AWS Regions + * [AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html) helps you model and set up your AWS resources, provision them quickly and consistently, and manage them throughout their lifecycle. You can use a template to describe your resources and their dependencies, and launch and configure them together as a stack, instead of managing resources individually. You can manage and provision stacks across multiple AWS accounts and AWS Regions. + + + + +## Best practices + + * **Configure network access for image builders correctly** – Launch image builders in virtual private cloud (VPC) subnets with proper internet access by using a NAT gateway for outbound-only internet access. + +Test network connectivity to required resources (such as application servers, databases, and licensing servers) before creating images. Verify that VPC route tables allow connections to all necessary network resources. For more information, see [Internet access](https://docs.aws.amazon.com/appstream2/latest/developerguide/internet-access.html) in the WorkSpaces Applications documentation. + + * **Monitor fleet capacity against service quotas proactively** – WorkSpaces Applications instance type and size quotas are per AWS account, per AWS Region. If you have multiple fleets in the same Region that use the same instance type and size, the total number of instances in all fleets in that Region must be less than or equal to the applicable quota. For more information, see [Troubleshooting Fleets](https://docs.aws.amazon.com/appstream2/latest/developerguide/troubleshooting-fleets.html) in the WorkSpaces Applications documentation. + + + + + * **Test applications in Image Builder Test mode before fleet deployment** – Always validate applications in Image Builder Test mode before creating images and deploying to fleets. Test mode simulates the limited permissions that end users have on fleet instances. For more information, see [Troubleshooting Image Builders](https://docs.aws.amazon.com/appstream2/latest/developerguide/troubleshooting-image-builder.html#troubleshooting-07) in the WorkSpaces Applications documentation. @@ -75,2 +91,3 @@ Install custom software and create an image.| - 1. Install the WorkSpaces Applications application that you plan to deploy to your users. - 2. Use the Photon create image agent or a PowerShell script to create a new Windows image for your custom software. + 1. Launch[ image builder](https://docs.aws.amazon.com/appstream2/latest/developerguide/tutorial-image-builder-create.html) and choose the relevant instance types, subnet, security group, and so on. + 2. Use admin mode while connecting to the instance. + 3. Use the [Image assistant](https://docs.aws.amazon.com/appstream2/latest/developerguide/tutorial-image-builder.html) or a PowerShell script to create a new Windows image for your custom software. @@ -88 +105 @@ Update the CloudFormation template.| - 1. Save the code in the Additional information section of this pattern as a YAML file. + 1. Use the code in the Additional information section of this pattern as a YAML file. @@ -103,0 +121,6 @@ Create a CloudFormation stack by using the template.| +## Troubleshooting + +Issue| Solution +---|--- +Various issues| For more information, see [Troubleshooting](https://docs.aws.amazon.com/appstream2/latest/developerguide/troubleshooting.html) in the WorkSpaces Applications documentation. + @@ -128 +151 @@ Create a CloudFormation stack by using the template.| -The following code is an example of a CloudFormation template that allows you to automatically create WorkSpaces Applications resources. +The following code is an example of a CloudFormation template that you can use to automatically create WorkSpaces Applications resources.