AWS workspaces: Add S3 bucket IAM policies for WorkSpaces Pools access

Service: workspaces · 2026-09-27 · Documentation medium

File: workspaces/latest/adminguide/managing-network-vpce-iam-policy.md · Type: iam

Summary

Replaced the generic commercial/GovCloud policy text with explicit S3 bucket policies granting the WorkSpacesPoolSession assumed role ListBucket/GetObject/PutObject/DeleteObject (and version variants) on wspool-app-settings-*, wspool-home-folder-*, and wspool-logs-* buckets, for both commercial and GovCloud regions.

Security assessment

The change documents the IAM resource-based policy required for WorkSpaces Pools to access S3 buckets, scoping permissions to a specific assumed-role principal and prefixed bucket ARNs. It is security-relevant configuration guidance (least-privilege scoping) but does not address a specific vulnerability or incident.

Evidence

+                    "AWS": "arn:aws:sts::111122223333:assumed-role/workspaces_DefaultRole/WorkSpacesPoolSession"

Diff

diff --git a/workspaces/latest/adminguide/managing-network-vpce-iam-policy.md b/workspaces/latest/adminguide/managing-network-vpce-iam-policy.md
index 558c9e5c6..74d5cfb49 100644
--- a//workspaces/latest/adminguide/managing-network-vpce-iam-policy.md
+++ b//workspaces/latest/adminguide/managing-network-vpce-iam-policy.md
@@ -10,0 +11,2 @@ When you enable Application Settings Persistence for a WorkSpaces Pool or Home f
+Use the following policy for resources in your Region type. Replace `111122223333` with your AWS account ID:
+
@@ -14 +16,26 @@ Commercial AWS Regions
-Use the following policy for resources in the commercial AWS Regions.
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "AllowWorkSpacesPoolsToAccessS3Buckets",
+                "Effect": "Allow",
+                "Principal": {
+                    "AWS": "arn:aws:sts::111122223333:assumed-role/workspaces_DefaultRole/WorkSpacesPoolSession"
+                },
+                "Action": [
+                    "s3:ListBucket",
+                    "s3:GetObject",
+                    "s3:PutObject",
+                    "s3:DeleteObject",
+                    "s3:GetObjectVersion",
+                    "s3:DeleteObjectVersion"
+                ],
+                "Resource": [
+                    "arn:aws:s3:::wspool-app-settings-*",
+                    "arn:aws:s3:::wspool-home-folder-*",
+                    "arn:aws:s3:::wspool-logs-*"
+                ]
+            }
+        ]
+    }
@@ -19 +46,26 @@ AWS GovCloud (US) Regions
-Use the following policy for resources in the commercial AWS GovCloud (US) Regions.
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "AllowWorkSpacesPoolsToAccessS3Buckets",
+                "Effect": "Allow",
+                "Principal": {
+                    "AWS": "arn:aws-us-gov:sts::111122223333:assumed-role/workspaces_DefaultRole/WorkSpacesPoolSession"
+                },
+                "Action": [
+                    "s3:ListBucket",
+                    "s3:GetObject",
+                    "s3:PutObject",
+                    "s3:DeleteObject",
+                    "s3:GetObjectVersion",
+                    "s3:DeleteObjectVersion"
+                ],
+                "Resource": [
+                    "arn:aws-us-gov:s3:::wspool-app-settings-*",
+                    "arn:aws-us-gov:s3:::wspool-home-folder-*",
+                    "arn:aws-us-gov:s3:::wspool-logs-*"
+                ]
+            }
+        ]
+    }