AWS workspaces high security documentation change
Summary
Renamed 'device allowlist' to 'device compatibility filter' and added explicit warnings that it's not a security boundary
Security assessment
Added explicit warning 'Do not rely on it as a security boundary' and modified best practices to emphasize security limitations. This addresses potential security misconfigurations where admins might mistakenly rely on the filter for access control.
Diff
diff --git a/workspaces/latest/adminguide/group_policy.md b/workspaces/latest/adminguide/group_policy.md index de68c5899..a1e286f3f 100644 --- a//workspaces/latest/adminguide/group_policy.md +++ b//workspaces/latest/adminguide/group_policy.md @@ -1255 +1255 @@ Amazon recommends using generic redirection only for devices where optimized red -USB redirection is disabled by default. You can enable the feature by using Group Policy Objects (GPO). After the feature is enabled, you can add devices to the allowlist for redirection. By default, devices not in the allowlist are not available for redirection. +USB redirection is disabled by default. You can enable the feature by using Group Policy Objects (GPO). After the feature is enabled, you can add devices to the device compatibility filter for redirection. By default, devices not in the filter are not available for redirection. @@ -1286 +1286 @@ Changes to this setting are applied on the next connection. -After USB redirection is enabled, you can configure the device allowlist in the GPO to add devices that you want to support for redirection. +After USB redirection is enabled, you can configure the device compatibility filter in the GPO to add devices that you want to support for redirection. @@ -1288 +1288 @@ After USB redirection is enabled, you can configure the device allowlist in the -##### Device Allowlist Configuration +##### Device compatibility filter configuration @@ -1290 +1290 @@ After USB redirection is enabled, you can configure the device allowlist in the -USB redirection follows a default deny-all security stance. Administrators must explicitly allow devices by adding them to the allowlist in the GPO using the following format: +The device compatibility filter determines which USB devices are recognized for redirection. This filter is not a security access control. Do not rely on it as a security boundary. Administrators must explicitly add devices to the filter in the GPO using the following format: @@ -1312 +1312 @@ USB redirection follows a default deny-all security stance. Administrators must -Test devices for compatibility and performance before adding them to the allowlist. +Test devices for compatibility and performance before adding them to the device compatibility filter. @@ -1314,3 +1314 @@ Test devices for compatibility and performance before adding them to the allowli -#### Security Considerations - -##### Best Practices +#### Best practices @@ -1320 +1318 @@ Test devices for compatibility and performance before adding them to the allowli - * Implement strict device allowlists. + * Keep the device compatibility filter limited to devices your users need. This filter is a compatibility control, not a security boundary. @@ -1324,2 +1321,0 @@ Test devices for compatibility and performance before adding them to the allowli - * Assess data security implications before allowing new devices. -