AWS workspaces: Updated console permissions and BYOL requirements
Summary
Added new permissions and updated required actions for BYOL/WorkSpaces Advisor.
Security assessment
Documents IAM permissions required for console operations, supporting least-privilege security practices.
Evidence
* workspaces:InvokeOnboardingAgent
Diff
diff --git a/workspaces/latest/adminguide/wsp-console-permissions-ref.md b/workspaces/latest/adminguide/wsp-console-permissions-ref.md index 82fcfe924..2885e6c39 100644 --- a//workspaces/latest/adminguide/wsp-console-permissions-ref.md +++ b//workspaces/latest/adminguide/wsp-console-permissions-ref.md @@ -30,0 +31,4 @@ Some Amazon WorkSpaces APIs can only be called through the AWS Management Consol + * workspaces:InvokeOnboardingAgent + + * workspaces:Personalization + @@ -49 +53 @@ WorkSpaces Console operations | Required permissions -[Manage users in WorkSpaces Personal](https://docs.aws.amazon.com/workspaces/latest/adminguide/manage-workspaces-users.html) – To edit users and send user invitation email | workspaces:DirectoryAccessManagement workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DescribeWorkspaces workspaces:DescribeTags workspaces:DescribeWorkspaceBundles workspaces:DescribeWorkspacesConnectionStatus workspaces:DescribeWorkspaceAssociations workspaces:DescribeWorkspaceSnapshots workspaces:DescribeWorkspaceImages workspaces:DescribeConnectionAliases +[Manage users in WorkSpaces Personal](https://docs.aws.amazon.com/workspaces/latest/adminguide/manage-workspaces-users.html) – To edit users and send user invitation email | workspaces:DirectoryAccessManagement workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DescribeWorkspaces workspaces:DescribeTags workspaces:DescribeWorkspaceBundles workspaces:DescribeWorkspacesConnectionStatus workspaces:DescribeWorkspaceAssociations workspaces:DescribeWorkspaceSnapshots workspaces:DescribeConnectionAliases @@ -52,2 +56,3 @@ WorkSpaces Console operations | Required permissions -[Enable your account for BYOL](https://docs.aws.amazon.com/workspaces/latest/adminguide/byol-windows-images.html) – To confirm understanding of the requirements to use BYOL WorkSpaces | workspaces:DescribeConsent workspaces:UpdateConsent workspaces:DescribeAccount workspaces:ListAccountLinks workspaces:DescribeWorkspaceBundles workspaces:DescribeWorkspaceImages workspaces:DescribeWorkspaceDirectories -[Amazon WorkSpaces Advisor](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-advisor.html) | workspaces:InvokeTroubleshootingInvestigation workspaces:GetTroubleshootingRecommendation workspaces:ListTroubleshootingRecommendations +[Enable your account for BYOL](https://docs.aws.amazon.com/workspaces/latest/adminguide/byol-windows-images.html) – To confirm understanding of the requirements to use BYOL WorkSpaces | workspaces:DescribeConsent workspaces:UpdateConsent workspaces:DescribeAccount workspaces:ListAccountLinks workspaces:DescribeWorkspaceBundles workspaces:DescribeWorkspaceDirectories +[Amazon WorkSpaces Advisor - Troubleshooting](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-advisor.html) | workspaces:InvokeTroubleshootingInvestigation workspaces:GetTroubleshootingRecommendation workspaces:ListTroubleshootingRecommendations +Amazon WorkSpaces Advisor - Create a WorkSpace using guided setup | workspaces:InvokeOnboardingAgent workspaces:Personalization workspaces:RegisterWorkspaceDirectory workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DirectoryAccessManagement workspaces:DescribeWorkspaceBundles workspaces:CreateWorkspaces workspaces:DescribeWorkspaces workspaces:DescribeTags workspaces:CreateTags workspaces:DescribeSupportedAvailabilityZones ds:CreateMicrosoftAD ds:AddTagsToResource ds:AuthorizeApplication ds:DescribeDirectories ds:DescribeTrusts ec2:CreateVpc ec2:ModifyVpcAttribute ec2:CreateSubnet ec2:CreateInternetGateway ec2:AttachInternetGateway ec2:CreateRoute ec2:CreateSecurityGroup ec2:CreateNetworkInterface ec2:CreateTags ec2:AuthorizeSecurityGroupIngress ec2:AuthorizeSecurityGroupEgress ec2:RevokeSecurityGroupEgress ec2:DescribeVpcs ec2:DescribeSubnets ec2:DescribeNetworkInterfaces ec2:DescribeInternetGateways ec2:DescribeRouteTables kms:ListKeys kms:ListAliases kms:DescribeKey iam:CreateRole iam:GetRole iam:PutRolePolicy