AWS workspaces: WorkSpaces Personal: add recommendation/copy creation methods and encryption steps
Summary
Restructures the WorkSpaces Personal creation guide, adding new 'Get a Recommendation' and 'Copy from an existing WorkSpace' flows, a note about the workspaces:Personalization permission, and updated manual configuration steps including selecting a KMS key for root/user volume encryption.
Security assessment
The diff documents encryption configuration (selecting a KMS key for root/user volumes) and notes the additional workspaces:Personalization permission required by the recommendation flow. These are security-relevant best-practice/feature docs, but there is no evidence of addressing a specific vulnerability or incident.
Evidence
* To enable encryption for the root volume, user volume, or both, select the volumes under **Encryption** , and then select a KMS key. For more information, see [Encrypted WorkSpaces in WorkSpaces Personal](./encrypt-workspaces.html).
Diff
diff --git a/workspaces/latest/adminguide/create-workspaces-personal.md b/workspaces/latest/adminguide/create-workspaces-personal.md index 77e6771f0..0aa822a07 100644 --- a//workspaces/latest/adminguide/create-workspaces-personal.md +++ b//workspaces/latest/adminguide/create-workspaces-personal.md @@ -7 +7 @@ -Connect to the WorkSpaceNext steps +Get a RecommendationCopy from an existing WorkSpaceConfigure manuallyConnect to the WorkSpaceNext steps @@ -12,0 +13,134 @@ WorkSpaces enables you to provision virtual, cloud-based Windows and Linux deskt +You can create a WorkSpace by: + + * **Getting a Recommendation** – Provide details of how you will use your WorkSpace, and WorkSpaces Advisor will give you tailored guidance of how you should configure your WorkSpace, including which bundle to use and how to set up a recommended directory. + + * **Copy from an existing WorkSpace** – If you already have an existing WorkSpace that is configured to your needs, you can select the WorkSpace and create another WorkSpace that will be configured exactly the same. + + * **Configure manually** – Choose your own bundle, directory, and other settings without guidance. + + + + +## Get a Recommendation + +WorkSpaces Advisor can guide you through the steps to create a WorkSpace, based on the input you provide. To get started: + +###### Note + + * The recommendation flow requires additional permissions beyond the standard create flow, including `workspaces:Personalization`, which stores your use-case answers and recommendations. For the complete list, see [Amazon WorkSpaces Console operations permissions reference](./wsp-console-permissions-ref.html). + + * **Get a Recommendation** is not available in the Africa (Cape Town) Region or the AWS GovCloud (US) Regions, and does not support Bring Your Own License (BYOL) bundles. In those cases, create your WorkSpace manually. For instructions, see Configure manually. + + + + +###### To create a WorkSpace with a recommendation + + 1. Open the WorkSpaces console at [https://console.aws.amazon.com/workspaces/v2/home](https://console.aws.amazon.com/workspaces/v2/home). + + 2. In the navigation pane, choose **WorkSpaces** , **Personal**. + + 3. Choose **Create WorkSpaces**. + + 4. For **Creation method** , keep **Get a Recommendation** , which is selected by default. + + 5. Choose the category that best represents your end user, and describe the tasks or applications that the WorkSpace will be used for. Then choose **Get recommendations** to see which WorkSpaces Personal bundles are best suited for your use case. + + 6. Choose a recommended bundle, or expand **Or choose your own** to select a different WorkSpaces bundle. Then choose **Choose bundle**. + + 7. Choose a running mode. WorkSpaces Advisor recommends a running mode based on your previous answers. + + 8. Proceed to the **Directory and users** section to create or choose a directory for your WorkSpace. If you already have a directory, WorkSpaces Advisor may suggest reusing it. If not, WorkSpaces Advisor guides you through the steps to create a new directory. Creating a new directory can take up to 40 minutes. You can leave the page and return later; provisioning continues in the background. + +###### Note + +If a provisioning step fails, you can edit your input and retry, or discard the retry and start over. Resources created during a failed attempt—such as the VPC, subnets, or directory—are not deleted automatically, and may continue to incur charges until you delete them. + + 9. Select or create the user to provision the WorkSpace for. + + 10. Under **Customization** (optional), you can customize volume sizes, root and user volume encryption, and nested virtualization. + + * To enable encryption for the root volume, user volume, or both, select the volumes under **Encryption** , and then select a KMS key. For more information, see [Encrypted WorkSpaces in WorkSpaces Personal](./encrypt-workspaces.html). + + * To enable nested virtualization, expand **Nested virtualization** and select **Enable Nested Virtualization**. With nested virtualization, you can run hypervisors such as Hyper-V and KVM inside your WorkSpace. This enables tools like Docker Desktop and WSL2. For more information, see [Nested virtualization for WorkSpaces Personal](./nested-virtualization.html). + +###### Note + +Nested virtualization is available only on non-GPU bundles that use the DCV (WSP) protocol with a supported operating system. For the full list of supported configurations, see [Nested virtualization for WorkSpaces Personal](./nested-virtualization.html). + + 11. Under **Tags** (optional), specify the key-value pairs that you want to use. + + 12. Choose **Create WorkSpaces**. A status page tracks the WorkSpace creation (typically 10–20 minutes); you can leave the page and check back later. The initial status of the WorkSpace is `PENDING`. When the creation is complete, the status is `AVAILABLE`, the status page shows the registration code and the steps to connect, and an invitation is sent to the email address that you specified for the user. + + 13. Send invitations to the email address for each user. For more information, see [Send an invitation email](./manage-workspaces-users.html#send-invitation). + +###### Note + + * These invitations aren't sent automatically if you're using AD Connector or a trust relationship. + + * Invitation emails aren't sent if the user already exists in Active Directory. Instead, make sure you manually send the user an invitation email. For more information, see [Send an invitation email](./manage-workspaces-users.html#send-invitation). + + * In all Regions, the text of the invitation email is in English (US). In the following Regions, the English text is preceded by a second language: + + * Asia Pacific (Seoul): Korean + + * Asia Pacific (Tokyo): Japanese + + * Canada (Central): French (Canadian) + + * China (Ningxia): Simplified Chinese + + 14. Proceed to Connect to the WorkSpace. + + + + +## Copy from an existing WorkSpace + +If you have configured an existing WorkSpace and would like to create new WorkSpaces that are identically configured, you can copy an existing WorkSpace to up to 25 new WorkSpaces. + +###### To copy an existing WorkSpace + + 1. Open the WorkSpaces console at [https://console.aws.amazon.com/workspaces/v2/home](https://console.aws.amazon.com/workspaces/v2/home). + + 2. In the navigation pane, choose **WorkSpaces** , **Personal**. + + 3. Choose **Create WorkSpaces**. + + 4. For **Creation method** , choose **Copy from an existing WorkSpace**. + + 5. Under **Select WorkSpace** , choose the existing WorkSpace that you want to copy. + + 6. Proceed to the **Users** section to choose the users that will use the new WorkSpaces. A WorkSpace is created for each user that you select. You can only choose users that are in the same directory as the one used with the existing WorkSpace. + + 7. Under **Customization** (optional), review the storage and encryption settings copied from the source WorkSpace, and adjust them if needed. + + 8. Under **Tags** (optional), specify the key-value pairs that you want to use. + + 9. Choose **Create WorkSpaces**. The initial status of the WorkSpace is `PENDING`. When the creation is complete, the status is `AVAILABLE` and an invitation is sent to the email address that you specified for the user. + + 10. Send invitations to the email address for each user. For more information, see [Send an invitation email](./manage-workspaces-users.html#send-invitation). + +###### Note + + * These invitations aren't sent automatically if you're using AD Connector or a trust relationship. + + * Invitation emails aren't sent if the user already exists in Active Directory. Instead, make sure you manually send the user an invitation email. For more information, see [Send an invitation email](./manage-workspaces-users.html#send-invitation). + + * In all Regions, the text of the invitation email is in English (US). In the following Regions, the English text is preceded by a second language: + + * Asia Pacific (Seoul): Korean + + * Asia Pacific (Tokyo): Japanese + + * Canada (Central): French (Canadian) + + * China (Ningxia): Simplified Chinese + + 11. Proceed to Connect to the WorkSpace. + + + + +## Configure manually + @@ -44,5 +178 @@ Now that you have created a directory, you are ready to create a personal WorkSp - 2. In the navigation pane, choose **WorkSpaces**. - - 3. Choose **Launch WorkSpaces** , **Personal**. - - 4. Choose **Create WorkSpaces** + 2. In the navigation pane, choose **WorkSpaces** , **Personal**. @@ -50 +180 @@ Now that you have created a directory, you are ready to create a personal WorkSp - 5. Under **Onboarding** (optional), you can choose **Recommend options to me based on my use case** to get recommendations on the type of WorkSpace you want to use. You can skip this step if you know that you want to use personal WorkSpaces. + 3. Choose **Create WorkSpaces**. @@ -52 +182 @@ Now that you have created a directory, you are ready to create a personal WorkSp - 6. Choose **Next**. WorkSpaces registers your AD Connector. + 4. For **Creation method** , choose **Configure manually**. @@ -54 +184 @@ Now that you have created a directory, you are ready to create a personal WorkSp - 7. Under **Configure WorkSpaces** , enter the following details: + 5. Under **Configure personal WorkSpace** , enter the following details: @@ -56 +186 @@ Now that you have created a directory, you are ready to create a personal WorkSp - * For **Bundle** , choose from the following the bundle type that you want to use for your WorkSpaces. + * For **Bundle type** , choose from the following the bundle type that you want to use for your WorkSpaces. @@ -58 +188 @@ Now that you have created a directory, you are ready to create a personal WorkSp - * **Use a base WorkSpaces bundle** \- Choose one of the bundles from the drop down. For more information about the bundle type you selected, choose **Bundle details**. To compare bundles offered for pools, choose **Compare all bundles**. + * **Use a WorkSpaces bundle** – Choose one of the bundles from the drop down. For more information about the bundle type you selected, choose **Bundle details**. To compare available bundles, choose **Compare all bundles**. @@ -60 +190 @@ Now that you have created a directory, you are ready to create a personal WorkSp - * **Use your own custom or BYOL bundle** \- Choose a bundle that you previously created. To create a custom bundle, see [Create a custom WorkSpaces image and bundle for WorkSpaces Personal](./create-custom-bundle.html). + * **Use your own custom or BYOL bundle** – Choose a bundle that you previously created. To create a custom bundle, see [Create a custom WorkSpaces image and bundle for WorkSpaces Personal](./create-custom-bundle.html). @@ -66 +196 @@ Review the recommended uses and specifications of each bundle to help ensure you - * For **Running mode** , choose from the following to configure your personal WorkSpace’s immediate availability and how you pay for it (monthly or hourly): + * For **Running mode** , choose from the following to configure your personal WorkSpace's availability and how you pay for it (monthly or hourly): @@ -68 +198 @@ Review the recommended uses and specifications of each bundle to help ensure you - * **AlwaysOn** — Bills monthly fee for unlimited usage of your WorkSpaces. This mode is best for users who use their WorkSpace full time as their primary desktop. + * **AlwaysOn** – Your WorkSpace is always available and you pay a fixed monthly fee. This mode is best for users who use their WorkSpace full time as their primary desktop. @@ -70 +200 @@ Review the recommended uses and specifications of each bundle to help ensure you - * **AutoStop** — Bills by the hour. With this mode, your WorkSpaces stop after a specified period of disconnection, and the state of apps and data is saved. + * **AutoStop** – Your WorkSpace stops after a period of inactivity and you pay by the hour. You can configure how long the WorkSpace waits before it stops. @@ -72,3 +202 @@ Review the recommended uses and specifications of each bundle to help ensure you - * For **Tags** , specify the key pair value that you want to use. A key can be a general category, such as "project," "owner," or "environment," with specific associated values. - - 8. Under **Select directory** , enter the following details: + 6. Under **User assignment** , enter the following details: @@ -78 +206 @@ Review the recommended uses and specifications of each bundle to help ensure you - * Choose the users from that directory you want to provision personal WorkSpaces for by doing the following. + * Choose the users from that directory you want to provision personal WorkSpaces for. To create users, do the following. @@ -80 +208 @@ Review the recommended uses and specifications of each bundle to help ensure you - 1. Choose **Create users**. + 1. Choose **Create user**. @@ -82 +210 @@ Review the recommended uses and specifications of each bundle to help ensure you - 2. Enter the user’s **Username** , **First name** , **Last name** , and **Email**. To add additional users, choose **Create additional user** and enter their information. + 2. Enter the user's **Username** , **First name** , **Last name** , and **Email**. To add additional users, choose **Add another user** and enter their information. You can add up to 5 users at a time. @@ -84 +212 @@ Review the recommended uses and specifications of each bundle to help ensure you - 9. Under **Customization** (optional), you can customize bundles, root and user volume encryption, nested virtualization, and user volume for all users or specific users. + 7. Under **Customization** (optional), you can customize volume sizes, root and user volume encryption, and nested virtualization. @@ -86 +214 @@ Review the recommended uses and specifications of each bundle to help ensure you - * To enable encryption for the root volume, user volume, or both, select **Encryption**. For more information, see [Encrypted WorkSpaces in WorkSpaces Personal](./encrypt-workspaces.html). + * To enable encryption for the root volume, user volume, or both, select the volumes under **Encryption** , and then select a KMS key. For more information, see [Encrypted WorkSpaces in WorkSpaces Personal](./encrypt-workspaces.html). @@ -88 +216 @@ Review the recommended uses and specifications of each bundle to help ensure you - * To enable nested virtualization, expand the **Nested virtualization** section and select **Enable Nested Virtualization**. Nested virtualization allows you to run hypervisors such as Hyper-V and KVM inside your WorkSpace, enabling tools like Docker Desktop and WSL2. For more information, see [Nested virtualization for WorkSpaces Personal](https://docs.aws.amazon.com/workspaces/latest/adminguide/nested-virtualization.html). + * To enable nested virtualization, expand **Nested virtualization** and select **Enable Nested Virtualization**. With nested virtualization, you can run hypervisors such as Hyper-V and KVM inside your WorkSpace. This enables tools like Docker Desktop and WSL2. For more information, see [Nested virtualization for WorkSpaces Personal](./nested-virtualization.html). @@ -92 +220,3 @@ Review the recommended uses and specifications of each bundle to help ensure you