AWS workspaces: Updated WorkSpaces console IAM permissions reference
Summary
Updated the WorkSpaces console permissions reference: clarified the 'Creating a WorkSpace' entry, replaced the Advisor guided setup entry with a 'Get a Recommendation' entry including new IAM and EC2 permissions, and changed 'streaming instances' to 'WorkSpaces Pool instances'.
Security assessment
The change updates the IAM permissions reference for WorkSpaces console operations, adding a new set of permissions (including iam:CreateRole, iam:PutRolePolicy, ec2:CreateVpc, etc.) for the 'Get a Recommendation' feature. This documents required permissions but does not address a specific vulnerability or incident.
Evidence
+[Amazon WorkSpaces Advisor - Create a WorkSpace with a recommendation](https://docs.aws.amazon.com/workspaces/latest/adminguide/create-workspaces-personal.html#create-workspaces-get-recommendation) – To create a WorkSpace using the **Get a Recommendation** creation method, including the guided directory creation it can perform for you | workspaces:InvokeOnboardingAgent workspaces:Personalization workspaces:RegisterWorkspaceDirectory workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DirectoryAccessManagement workspaces:DescribeWorkspaceBundles workspaces:CreateWorkspaces workspaces:DescribeWorkspaces workspaces:DescribeTags workspaces:CreateTags workspaces:DescribeSupportedAvailabilityZones ds:CreateMicrosoftAD ds:AddTagsToResource ds:AuthorizeApplication ds:DescribeDirectories ds:DescribeTrusts ec2:CreateVpc ec2:ModifyVpcAttribute ec2:CreateSubnet ec2:CreateInternetGateway ec2:AttachInternetGateway ec2:CreateRoute ec2:CreateSecurityGroup ec2:CreateNetworkInterface ec2:CreateTags ec2:AuthorizeSecurityGroupIngress ec2:AuthorizeSecurityGroupEgress ec2:RevokeSecurityGroupEgress ec2:DescribeVpcs ec2:DescribeSubnets ec2:DescribeNetworkInterfaces ec2:DescribeInternetGateways ec2:DescribeRouteTables kms:ListKeys kms:ListAliases kms:DescribeKey iam:CreateRole iam:GetRole iam:PutRolePolicy
Diff
diff --git a/workspaces/latest/adminguide/wsp-console-permissions-ref.md b/workspaces/latest/adminguide/wsp-console-permissions-ref.md index 2885e6c39..74a34fb28 100644 --- a//workspaces/latest/adminguide/wsp-console-permissions-ref.md +++ b//workspaces/latest/adminguide/wsp-console-permissions-ref.md @@ -52 +52,2 @@ WorkSpaces Console operations | Required permissions -[Creating a WorkSpace in WorkSpaces Personal on the Console](https://docs.aws.amazon.com/workspaces/latest/adminguide/create-workspaces-personal.html) – To create/search/describe Directory Service directory users | workspaces:DirectoryAccessManagement workspaces:DescribeAccount workspaces:CreateWorkspaces workspaces:DescribeWorkspaces workspaces:DescribeWorkspaceDirectories workspaces:DescribeWorkspaceBundles workspaces:DescribeTags workspaces:CreateTags workspaces:DescribeClientProperties kms:ListKeys kms:ListAliases kms:DescribeKey ds:DescribeTrusts ds:DescribeDirectories ec2:DescribeSubnets ec2:DescribeSecurityGroups +[Creating a WorkSpace in WorkSpaces Personal on the Console](https://docs.aws.amazon.com/workspaces/latest/adminguide/create-workspaces-personal.html) – To create a WorkSpace using the **Configure manually** or **Copy from an existing WorkSpace** creation method, including creating, searching, and describing Directory Service directory users | workspaces:DirectoryAccessManagement workspaces:DescribeAccount workspaces:CreateWorkspaces workspaces:DescribeWorkspaces workspaces:DescribeWorkspaceDirectories workspaces:DescribeWorkspaceBundles workspaces:DescribeTags workspaces:CreateTags workspaces:DescribeClientProperties kms:ListKeys kms:ListAliases kms:DescribeKey ds:DescribeTrusts ds:DescribeDirectories ec2:DescribeSubnets ec2:DescribeSecurityGroups +[Amazon WorkSpaces Advisor - Create a WorkSpace with a recommendation](https://docs.aws.amazon.com/workspaces/latest/adminguide/create-workspaces-personal.html#create-workspaces-get-recommendation) – To create a WorkSpace using the **Get a Recommendation** creation method, including the guided directory creation it can perform for you | workspaces:InvokeOnboardingAgent workspaces:Personalization workspaces:RegisterWorkspaceDirectory workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DirectoryAccessManagement workspaces:DescribeWorkspaceBundles workspaces:CreateWorkspaces workspaces:DescribeWorkspaces workspaces:DescribeTags workspaces:CreateTags workspaces:DescribeSupportedAvailabilityZones ds:CreateMicrosoftAD ds:AddTagsToResource ds:AuthorizeApplication ds:DescribeDirectories ds:DescribeTrusts ec2:CreateVpc ec2:ModifyVpcAttribute ec2:CreateSubnet ec2:CreateInternetGateway ec2:AttachInternetGateway ec2:CreateRoute ec2:CreateSecurityGroup ec2:CreateNetworkInterface ec2:CreateTags ec2:AuthorizeSecurityGroupIngress ec2:AuthorizeSecurityGroupEgress ec2:RevokeSecurityGroupEgress ec2:DescribeVpcs ec2:DescribeSubnets ec2:DescribeNetworkInterfaces ec2:DescribeInternetGateways ec2:DescribeRouteTables kms:ListKeys kms:ListAliases kms:DescribeKey iam:CreateRole iam:GetRole iam:PutRolePolicy @@ -58 +58,0 @@ WorkSpaces Console operations | Required permissions -Amazon WorkSpaces Advisor - Create a WorkSpace using guided setup | workspaces:InvokeOnboardingAgent workspaces:Personalization workspaces:RegisterWorkspaceDirectory workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DirectoryAccessManagement workspaces:DescribeWorkspaceBundles workspaces:CreateWorkspaces workspaces:DescribeWorkspaces workspaces:DescribeTags workspaces:CreateTags workspaces:DescribeSupportedAvailabilityZones ds:CreateMicrosoftAD ds:AddTagsToResource ds:AuthorizeApplication ds:DescribeDirectories ds:DescribeTrusts ec2:CreateVpc ec2:ModifyVpcAttribute ec2:CreateSubnet ec2:CreateInternetGateway ec2:AttachInternetGateway ec2:CreateRoute ec2:CreateSecurityGroup ec2:CreateNetworkInterface ec2:CreateTags ec2:AuthorizeSecurityGroupIngress ec2:AuthorizeSecurityGroupEgress ec2:RevokeSecurityGroupEgress ec2:DescribeVpcs ec2:DescribeSubnets ec2:DescribeNetworkInterfaces ec2:DescribeInternetGateways ec2:DescribeRouteTables kms:ListKeys kms:ListAliases kms:DescribeKey iam:CreateRole iam:GetRole iam:PutRolePolicy @@ -66 +66 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Access to WorkSpaces and scripts on streaming instances +Access to WorkSpaces and scripts on WorkSpaces Pool instances