AWS workspaces documentation change
Summary
Updated BYOL Windows image requirements: added note about using existing infrastructure for WorkSpaces Applications, clarified minimum WorkSpaces counts for non-GPU and GPU bundles (now including WorkSpaces Applications), and moved the note about disabling BitLocker encryption to an earlier section.
Security assessment
The change explicitly documents that BitLocker disk encryption must be disabled before image import, which is a security-related requirement. However, this is not fixing a vulnerability but rather documenting existing security constraints.
Diff
diff --git a/workspaces/latest/adminguide/byol-windows-images.md b/workspaces/latest/adminguide/byol-windows-images.md index 4837538b9..a86fe1f96 100644 --- a//workspaces/latest/adminguide/byol-windows-images.md +++ b//workspaces/latest/adminguide/byol-windows-images.md @@ -18,0 +19,2 @@ Image creation is not supported on Windows 11 systems that have been upgraded fr +If your account is already enabled for BYOL, you do not need to provision new dedicated infrastructure to run WorkSpaces Applications fleets powered by Windows 11. The same dedicated hardware that supports your existing WorkSpaces Personal or Pools BYOL workloads can be used for WorkSpaces Applications. Simply import your Windows 11 BYOL image into WorkSpaces Applications and create a fleet from it. To learn more, see [Bring Your Own Windows Desktop Licenses for WorkSpaces Applications](https://docs.aws.amazon.com/appstream2/latest/developerguide/byol-windows-images.html). + @@ -42 +44,3 @@ Before you begin, verify the following: - * If you are using non-GPU-enabled bundles, verify that you use a minimum of 50 WorkSpaces per region in any mix of AlwaysOn and AutoStop configurations. This minimum is required to run WorkSpaces on dedicated hardware, which is necessary to comply with Microsoft licensing requirements. The dedicated hardware is provisioned by AWS, so your VPC can remain on default tenancy. + * For non-GPU-enabled bundles, a minimum of 50 WorkSpaces per Region per month is required. This minimum ensures workloads run on dedicated hardware in compliance with Microsoft licensing requirements. + + * The 50-instance minimum can be fulfilled by any combination of WorkSpaces Applications unique users streaming sessions (AlwaysOn or On-Demand) and WorkSpaces Personal instances within the same Region. The dedicated hardware is provisioned and managed by AWS — your VPC can remain on default tenancy. @@ -44 +48 @@ Before you begin, verify the following: -If you plan to use GPU-enabled bundles, verify that you run a minimum of 4 AlwaysOn or 20 AutoStop GPU-enabled WorkSpaces per region per month on dedicated hardware. + * If you plan to use GPU-enabled bundles, verify that you run a minimum of 4 AlwaysOn or 20 AutoStop GPU-enabled WorkSpaces and/or WorkSpaces Applications per region per month on dedicated hardware. @@ -162,0 +167,4 @@ You will need a Windows virtual machine image or Windows ISO image file that use +###### Important + +Software-level disk encryption such as Microsoft BitLocker must be disabled on the source image before importing. Images with BitLocker or other full-disk encryption software enabled will fail the import process. Ensure BitLocker is turned off and the volume is fully decrypted before exporting your VM for import. + @@ -171,4 +178,0 @@ You will need a Windows virtual machine image or Windows ISO image file that use - * ###### Important - -Software-level disk encryption such as Microsoft BitLocker must be disabled on the source image before importing. Images with BitLocker or other full-disk encryption software enabled will fail the import process. Ensure BitLocker is turned off and the volume is fully decrypted before exporting your VM for import. -