AWS workspaces: Rename 'streaming instances' to 'WorkSpaces Pool instances' in IAM roles guide
Summary
Terminology update throughout the IAM roles topic, replacing 'WorkSpaces streaming instances' with 'WorkSpaces Pool instances' and clarifying the topic applies to WorkSpaces Pools, not WorkSpaces Personal. No substantive security content changed.
Security assessment
The diff is purely a product-terminology rename (streaming instances -> WorkSpaces Pool instances) plus a scope clarification. Existing IAM/least-privilege guidance is unchanged, so there is no new security feature, fix, or vulnerability addressed.
Evidence
+In this topic, _WorkSpaces Pool instances_ are the streaming instances that run your WorkSpaces Pools. This topic applies to WorkSpaces Pools and does not apply to WorkSpaces Personal.
Diff
diff --git a/workspaces/latest/adminguide/using-iam-roles-to-grant-permissions-to-applications-scripts-streaming-instances.md b/workspaces/latest/adminguide/using-iam-roles-to-grant-permissions-to-applications-scripts-streaming-instances.md index bfbb0c52f..4077e05cd 100644 --- a//workspaces/latest/adminguide/using-iam-roles-to-grant-permissions-to-applications-scripts-streaming-instances.md +++ b//workspaces/latest/adminguide/using-iam-roles-to-grant-permissions-to-applications-scripts-streaming-instances.md @@ -7 +7 @@ -Best Practices for Using IAM Roles With WorkSpaces Streaming InstancesConfiguring an Existing IAM Role to Use With WorkSpaces Streaming InstancesHow to Create an IAM Role to Use With WorkSpaces Streaming InstancesHow to Use the IAM Role With WorkSpaces Streaming Instances +Best Practices for Using IAM Roles With WorkSpaces Pool instancesConfiguring an Existing IAM Role to Use With WorkSpaces Pool instancesHow to Create an IAM Role to Use With WorkSpaces Pool instancesHow to Use the IAM Role With WorkSpaces Pool instances @@ -9 +9 @@ Best Practices for Using IAM Roles With WorkSpaces Streaming InstancesConfigurin -# Access to WorkSpaces and scripts on streaming instances +# Access to WorkSpaces and scripts on WorkSpaces Pool instances @@ -11 +11 @@ Best Practices for Using IAM Roles With WorkSpaces Streaming InstancesConfigurin -Applications and scripts that run on WorkSpaces streaming instances must include AWS credentials in their AWS API requests. You can create an IAM role to manage these credentials. An IAM role specifies a set of permissions that you can use to access AWS resources. This role is not uniquely associated with one person, however. Instead, it can be assumed by anyone that needs it. +In this topic, _WorkSpaces Pool instances_ are the streaming instances that run your WorkSpaces Pools. This topic applies to WorkSpaces Pools and does not apply to WorkSpaces Personal. @@ -13 +13,3 @@ Applications and scripts that run on WorkSpaces streaming instances must include -You can apply an IAM role to a WorkSpaces streaming instance. When the streaming instance switches to (assumes) the role, the role provides temporary security credentials. Your application or scripts use these credentials to perform API actions and management tasks on the streaming instance. WorkSpaces manages the temporary credential switch for you. +Applications and scripts that run on WorkSpaces Pool instances must include AWS credentials in their AWS API requests. You can create an IAM role to manage these credentials. An IAM role specifies a set of permissions that you can use to access AWS resources. This role is not uniquely associated with one person, however. Instead, it can be assumed by anyone that needs it. + +You can apply an IAM role to a WorkSpaces Pool instance. When the WorkSpaces Pool instance switches to (assumes) the role, the role provides temporary security credentials. Your application or scripts use these credentials to perform API actions and management tasks on the WorkSpaces Pool instance. WorkSpaces manages the temporary credential switch for you. @@ -17 +19 @@ You can apply an IAM role to a WorkSpaces streaming instance. When the streaming - * Best Practices for Using IAM Roles With WorkSpaces Streaming Instances + * Best Practices for Using IAM Roles With WorkSpaces Pool instances @@ -19 +21 @@ You can apply an IAM role to a WorkSpaces streaming instance. When the streaming - * Configuring an Existing IAM Role to Use With WorkSpaces Streaming Instances + * Configuring an Existing IAM Role to Use With WorkSpaces Pool instances @@ -21 +23 @@ You can apply an IAM role to a WorkSpaces streaming instance. When the streaming - * How to Create an IAM Role to Use With WorkSpaces Streaming Instances + * How to Create an IAM Role to Use With WorkSpaces Pool instances @@ -23 +25 @@ You can apply an IAM role to a WorkSpaces streaming instance. When the streaming - * How to Use the IAM Role With WorkSpaces Streaming Instances + * How to Use the IAM Role With WorkSpaces Pool instances @@ -28 +30 @@ You can apply an IAM role to a WorkSpaces streaming instance. When the streaming -## Best Practices for Using IAM Roles With WorkSpaces Streaming Instances +## Best Practices for Using IAM Roles With WorkSpaces Pool instances @@ -30 +32 @@ You can apply an IAM role to a WorkSpaces streaming instance. When the streaming -When you use IAM roles with WorkSpaces streaming instances, we recommend that you follow these practices: +When you use IAM roles with WorkSpaces Pool instances, we recommend that you follow these practices: @@ -34 +36 @@ When you use IAM roles with WorkSpaces streaming instances, we recommend that yo -Follow least privilege principles when you create and attach IAM policies to the IAM roles associated with WorkSpaces streaming instances. When you use an application or script that requires access to AWS API actions or resources, determine the specific actions and resources that are required. Then, create policies that allow the application or script to perform only those actions. For more information, see [Grant Least Privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege) in the _IAM User Guide_. +Follow least privilege principles when you create and attach IAM policies to the IAM roles associated with WorkSpaces Pool instances. When you use an application or script that requires access to AWS API actions or resources, determine the specific actions and resources that are required. Then, create policies that allow the application or script to perform only those actions. For more information, see [Grant Least Privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege) in the _IAM User Guide_. @@ -47 +49 @@ IAM policies let you define the conditions under which your IAM role can be used -## Configuring an Existing IAM Role to Use With WorkSpaces Streaming Instances +## Configuring an Existing IAM Role to Use With WorkSpaces Pool instances @@ -55 +57 @@ The IAM role that you want to use with WorkSpaces must meet the following prereq - * The IAM role must be in the same Amazon Web Services account as the WorkSpaces streaming instance. + * The IAM role must be in the same Amazon Web Services account as the WorkSpaces Pool instance. @@ -104 +106 @@ JSON - 7. The IAM role that you selected will display in the WorkSpaces console. This role grants permissions to applications and scripts to perform API actions and management tasks on streaming instances. + 7. The IAM role that you selected will display in the WorkSpaces console. This role grants permissions to applications and scripts to perform API actions and management tasks on WorkSpaces Pool instances. @@ -109 +111 @@ JSON -## How to Create an IAM Role to Use With WorkSpaces Streaming Instances +## How to Create an IAM Role to Use With WorkSpaces Pool instances @@ -142 +144 @@ After you create the policy, close that tab and return to your original tab. Sel -## How to Use the IAM Role With WorkSpaces Streaming Instances +## How to Use the IAM Role With WorkSpaces Pool instances @@ -150 +152 @@ When you make the API calls, specify **workspaces_machine_role** as the credenti -WorkSpaces assumes the specified role while the streaming instance is provisioned. Because WorkSpaces uses the elastic network interface that is attached to your VPC for AWS API calls, your application or script must wait for the elastic network interface to become available before making AWS API calls. If API calls are made before the elastic network interface is available, the calls fail. +WorkSpaces assumes the specified role while the WorkSpaces Pool instance is provisioned. Because WorkSpaces uses the elastic network interface that is attached to your VPC for AWS API calls, your application or script must wait for the elastic network interface to become available before making AWS API calls. If API calls are made before the elastic network interface is available, the calls fail. @@ -152 +154 @@ WorkSpaces assumes the specified role while the streaming instance is provisione -The following examples show how you can use the **workspaces_machine_role** credential profile to describe streaming instances (EC2 instances) and to create the Boto client. Boto is the Amazon Web Services (AWS) SDK for Python. +The following examples show how you can use the **workspaces_machine_role** credential profile to describe EC2 instances and to create the Boto client. Boto is the Amazon Web Services (AWS) SDK for Python. @@ -154 +156 @@ The following examples show how you can use the **workspaces_machine_role** cred -**Describe Streaming Instances (EC2 instances) by Using the AWS CLI** +**Describe EC2 instances by Using the AWS CLI** @@ -159 +161 @@ The following examples show how you can use the **workspaces_machine_role** cred -**Describe Streaming Instances (EC2 instances) by Using AWS Tools for PowerShell** +**Describe EC2 instances by Using AWS Tools for PowerShell**