AWS workspaces: Document security impact of nested virtualization
Summary
Added note about automatic disablement of Credential Guard/VBS when nested virtualization is enabled.
Security assessment
Documents security trade-off where enabling a feature (nested virtualization) disables credential protection mechanisms.
Evidence
+When you enable nested virtualization on a Windows WorkSpace, Credential Guard and VBS are automatically disabled.
Diff
diff --git a/workspaces/latest/adminguide/credential-guard-vbs.md b/workspaces/latest/adminguide/credential-guard-vbs.md index 6b8a30b6f..65b0fbb60 100644 --- a//workspaces/latest/adminguide/credential-guard-vbs.md +++ b//workspaces/latest/adminguide/credential-guard-vbs.md @@ -10,0 +11,4 @@ Windows WorkSpaces can utilize Credential Guard and Virtualization-Based Securit +###### Note + +When you enable nested virtualization on a Windows WorkSpace, Credential Guard and VBS are automatically disabled. This is required because nested virtualization uses the hardware virtualization extensions that VBS relies on. If you need both Credential Guard and nested virtualization, they cannot be enabled on the same WorkSpace simultaneously. For more information, see [Nested virtualization for WorkSpaces Personal](https://docs.aws.amazon.com/workspaces/latest/adminguide/nested-virtualization.html) and [Use nested virtualization to run hypervisors in Amazon EC2 instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/amazon-ec2-nested-virtualization.html). +