Q: What is Amazon WorkSpaces?
Amazon WorkSpaces is a fully managed desktop computing service in the cloud. Amazon WorkSpaces allows customers to easily provision cloud-based desktops that allow end-users to access the documents, applications and resources they need with the device of their choice, including laptops, iPad, Kindle Fire, or Android tablets. With a few clicks in the AWS Management Console, customers can provision a high-quality desktop experience for any number of users at a cost that is highly competitive with traditional desktops and half the cost of most virtual desktop infrastructure (VDI) solutions.
Q: What is a WorkSpace?
A WorkSpace is a cloud-based replacement for a traditional desktop. A WorkSpace is available as a bundle of compute resources, storage space, and software application access that allow a user to perform day-to-day tasks just like using a traditional desktop. A user can connect to a WorkSpace from any supported device (PC, Mac, iPad, Kindle Fire, or Android tablets) using a free Amazon WorkSpaces client application and credentials set up by an administrator, or their existing Active Directory credentials if WorkSpaces is integrated with an existing Active Directory domain. Once the user is connected to a WorkSpace they can perform all the usual tasks they would use a desktop computer for.
Q: How can I get started with WorkSpaces?
To get started with Amazon WorkSpaces, you will need an AWS account. You can use this account to sign into the AWS Management console and you can then quickly provision WorkSpaces for yourself and other users who might require one. To provision WorkSpaces you simply choose a WorkSpace bundle (a configuration of compute resources, storage space, and software applications) and assign it to a user. The WorkSpace will be provisioned for your user, who will receive an email with instructions for connecting to their WorkSpace.
Q: Which WorkSpaces bundles are available?
You can find the latest information on WorkSpaces bundles here.
Q: What Operating System does a WorkSpace run?
WorkSpaces provide users with the Windows 7 Experience, provided by Windows Server 2008 R2 with RDS.
Q: How does a user get started with a WorkSpace once it has been provisioned?
Once a WorkSpace is provisioned, users will receive an email with instructions explaining how they can connect to their WorkSpace. If you are not integrating with an existing Active Directory, the user will have the ability to set a password. Then, the user can download for free the appropriate WorkSpaces client application for the device(s) they wish to use and can then connect to their WorkSpace. If WorkSpaces Connect has been used to integrate with an existing Active Directory domain, users will use their regular Active Directory credentials.
Q: What does a user need to use a Workspace?
A user needs to have a WorkSpace provisioned for them and to have been provided with the connection instructions (which will be emailed to them, or provided by an administrator when their WorkSpace is ready), as well as a supported client device (PC, Mac, iPad, Kindle Fire, or Android tablet). Users will also need a broadband Internet connection with TCP ports 443 & 4172, and UDP port 4172 open.
Q: Once users connect to their WorkSpace can they personalize it with their favorite settings?
An administrator can control what a user can personalize in their WorkSpace. By default, users can personalize their WorkSpaces with their favorite settings for items such as wallpaper, icons, shortcuts, etc. These settings will be saved and persist until a user changes them. If an administrator wishes to lock down a WorkSpace using tools like Group Policy, this will restrict a user’s ability to personalize their WorkSpaces.
Q: Can users install applications on their WorkSpace?
By default, users are configured as local administrators of their WorkSpaces. Administrators can change this setting and can restrict users’ ability to install applications with a technology such as Group Policy.
Q: Are WorkSpaces persistent?
Yes. Each WorkSpace runs on an individual instance for the user it is assigned to. Applications and users’ documents and settings are persistent.
Q: How is a user’s data backed up?
The user volume (D:) on the WorkSpace is backed up every 12 hours. In the case of a WorkSpace failure, AWS can restore this volume from the backup. If Amazon Zocalo Sync is enabled on a WorkSpace, the folder a user chooses to sync will be continuously backed up and stored in Amazon Zocalo.
Q: Do users need an AWS account?
No. An AWS account is only needed to provision WorkSpaces. To connect to WorkSpaces users will require only the information provided in the invitation email they will receive when their WorkSpace is ready.
Q: If I am located a significant distance from the region where my WorkSpaces are located, will I have a good experience using Amazon WorkSpaces?
If you are located more than 2000 miles from the US East (N.Virginia), US West (Oregon), EU (Ireland), Asia Pacific (Sydney), or Asia Pacific (Tokyo) AWS regions where Amazon WorkSpaces is currently available, you can still use the service, but your experience may be less responsive.
Q: Can I create custom bundles for WorkSpaces?
No. Currently, you cannot create custom bundles.
Q: How do I deploy applications to my users?
You can either obtain applications by selecting one of the “Plus” bundles that are available with more software installed by default, or you can install your own software on the WorkSpace. If you install your own software, you can use whatever software distribution or installation method you prefer as long as it is supported by the underlying operating system (Windows 7 Experience provided by Windows Server 2008 R2).
Q: Which software can I install on a WorkSpace?
The WorkSpaces service does not have any technical restrictions on the kind of software that you can install, and any applications that are compatible with the Windows 7 experience provided by Windows Server 2008 R2 should run on your WorkSpaces. We recommend testing any software you would like to deploy on a ‘test’ WorkSpace before delivering it to more users. You are responsible for ensuring that you remain compliant with any licensing restrictions associated with any software you intend to install on a WorkSpace.
Q: Which credentials do users use to sign-in to WorkSpaces?
Users sign into their WorkSpace using their own unique credentials, which they can create after a WorkSpace has been provisioned for them. If you have integrated the WorkSpaces service with an existing Active Directory domain, users will sign in with their regular Active Directory credentials. WorkSpaces also integrates with your existing RADIUS server to enable multi-factor authentication.
Q: What is Multi-factor Authentication (MFA)?
Multi-Factor Authentication adds an additional layer of security during the authentication process. Users must validate their identity by providing something they know (e.g. password), as well as something they have (e.g. hardware or software generated one-time password (OTP)).
Q: What delivery methods are supported for MFA?
Amazon supports OTP that are delivered via hardware and software tokens. Out of band tokens, such as SMS tokens are not currently supported.
Q: Is there support for Google Authenticator and other virtual MFA solutions?
Google Authenticator can be used in conjunction with RADIUS. If you are running a Linux-based RADIUS server, you can configure your RADIUS fleet to use Google Authenticator through a PAM (Pluggable Authentication Module) library. MFA solutions based on the TOTP (Time-based One-time Password) protocol are not currently supported.
Q: What happens if a user forgets the password to access their WorkSpace?
If WorkSpaces Connect is used to integrate with an existing Active Directory domain, the user would follow the existing lost password process for your existing domain, such as contacting an internal helpdesk. If the user is using credentials stored in a directory managed by the WorkSpaces service, they can reset their password by clicking on the “Forgot Password” link in the WorkSpaces client application.
Q: How will a user’s WorkSpace be patched with software updates?
You have the ability to control how patching is configured for a user’s WorkSpace. By default, Windows Update is turned on, but you have the ability to customize these settings, or use an alternative patch management approach if you desire. Third party software will be updated according to the settings of the third party software’s update mechanism that you can control.
Q: How will Workspaces be protected from malware/viruses?
You can install your choice of anti-virus software on your users’ WorkSpaces. The “Plus” bundle options offer users access to anti-virus software, and you can find more details on this here. If you choose to install your own anti-virus software, please ensure that it does not block UDP port 4172, as this will prevent users connecting to their WorkSpaces.
Q: How do I remove a user’s access to a WorkSpace?
To remove a user’s access to a WorkSpace, you can disable their account either in the directory managed by the WorkSpaces service, or in an existing Active Directory that you have integrated the WorkSpaces service with.
Q: Does WorkSpaces work with AWS Identity and Access Management (IAM)?
Yes. Please see our documentation.
Q: Can I select the Organizational Unit (OU) where computer accounts for my WorkSpaces will be created in my Active Directory?
Yes. You can set a default Organizational Unit (OU) in which computer accounts for your WorkSpaces are created in your Active Directory. This OU can be part of the domain to which your users belong, or part of a domain that has a trust relationship with the domain to which your users belong, or part of a child domain in your directory. Please see our documentation for more details.
Q: Can I use Amazon VPC Security groups to limit access to resources (applications, databases) in my network or on the Internet from my WorkSpaces?
Yes. You can use Amazon VPC Security groups to limit access to resources in your network or the Internet from your WorkSpaces. You can select a default Amazon VPC Security Group for the WorkSpaces network interfaces in your VPC as part of the directory details on the WorkSpaces console. Please see our documentation for more details.
Q: What is Amazon Zocalo Sync?
Amazon Zocalo Sync (formerly WorkSpaces Sync) is a client application that you can install in a WorkSpace that you launch, which continuously, automatically, and securely backs up documents from a WorkSpace to Amazon Zocalo. You can also install Amazon Zocalo Sync on a Mac or PC to sync documents to or from a WorkSpace so that users can always have access to their data regardless of the desktop computer you are using. When a WorkSpace is launched, users will have a link on their desktop so that they can install Amazon Zocalo Sync. The client can be downloaded here.
Q: Can I enable or disable Amazon Zocalo Sync for a user’s WorkSpace?
When you create a directory, or use WorkSpaces Connect to integrate with an existing Active Directory, you can choose to enable or disable Amazon Zocalo Sync for that directory. Currently you cannot enable or disable Amazon Zocalo Sync on a per-user basis.
Q: How do I synchronize documents between a WorkSpace and a Mac or PC client?
To enable synchronization, all you need to do is install Amazon Zocalo Sync on both the WorkSpace itself, and the Mac or PC client you would like to synchronize with. On the Mac or PC and the WorkSpace, you choose which folder you want to synchronize and Amazon Zocalo Sync will automatically keep the folders in sync.
Q: Can I use any other client (e.g., an RDP client) with WorkSpaces?
No. The only supported clients for WorkSpaces are the free clients provided by AWS.
Q: Which operating systems are supported by the WorkSpaces client applications?
WorkSpaces clients are available for the following operating systems:
- Microsoft Windows 7 and Microsoft Windows 8
- Apple Mac OS X (10.8.1 and above)
Q: Which tablet devices are supported by the WorkSpaces client application?
WorkSpaces clients are available for the following devices:
- Apple iPad 2 (iOS 7.0 and above)
- Apple iPad Retina (iOS 7.0 and above)
- Kindle Fire HDX and Kindle HD 7
- Samsung and Nexus tablets (Android version 4.2 and above).
While we expect other popular Android tablets running Android version 4.2 to work correctly with the Amazon WorkSpaces client, there may be some that are not compatible. If you are interested in support for a particular device, please let us know via the Amazon WorkSpaces forum or by contacting us.
Q: Which peripherals can be used with the Amazon WorkSpaces client applications?
Amazon WorkSpaces clients support:
- Keyboard, mouse, and touch input (touch input is only supported on tablet clients)
- Audio output to client device
Q: Are dual monitors supported?
Yes, dual monitors are supported on the PC and Mac OS X WorkSpaces clients.
Q: Will the iPad and Android applications support Keyboard/Mouse input?
The iPad client supports keyboard input, and the Android client supports both keyboard and mouse input. While we expect most popular keyboard and mouse devices to work correctly, there may be devices that may not be compatible. If you are interested in support for a particular device, please let us know via the Amazon WorkSpaces forum or by contacting us.
Q: How do I print from my WorkSpaces?
If you have used WorkSpaces Connect to connect to an existing Active Directory, you can configure one of your existing printers on a user’s WorkSpace, and they can continue to print as normal. Local printing is also supported.
Q. Will Amazon WorkSpaces support additional client devices and virtual desktop operating systems?
We continually review our roadmap to see what features we can add to address our customers' requirements. If there is a client device or virtual desktop operating system that you'd like Amazon WorkSpaces to support, please email us with details of your request.
Q: What is the end user experience when MFA is enabled?
Users will be prompted for their Active Directory username and password, followed by their OTP. Once a user passes both Active Directory and RADIUS validation, they will be logged in to their Amazon WorkSpace. To learn more, visit our documentation.
Q: What languages are supported by Amazon WorkSpaces?
Amazon WorkSpaces and WorkSpace clients are currently supported in English (US) and Japanese.
Q: Does the WorkSpaces service have maintenance windows?
Yes. The current maintenance window is a four hour period from 0000 – 0400 (this time window will be based on the time zone of the AWS region where your WorkSpaces are located) each Sunday morning. During this time your WorkSpaces may not be available. The maintenance window is currently not configurable.
Q: Will my Amazon WorkSpaces require software updates?
Your Amazon WorkSpaces provide users with the Windows 7 experience, provided by Windows Server 2008 R2. The underlying OS, and any applications installed in the WorkSpace may need updates.
Q: How do I ensure my WorkSpaces are kept up to date?
For the underlying OS, Windows Update is enabled by default on WorkSpaces, and configured to install updates at 2am each Sunday. If you have chosen a “Plus” bundle that includes Microsoft Office 2010, updates for Office will also be configured to install at 2am each Sunday. You can choose to use an alternative patching approach if you require this or to configure Windows Update to perform updates at a time of your choosing. Other applications that you may install on your WorkSpace should be kept up to date using the ISV’s recommended patching techniques. In addition to OS or application updates, any software updates that are required for normal operation of the WorkSpaces service itself are also delivered automatically to your WorkSpaces. The WorkSpaces service updates will be released and installed automatically during scheduled maintenance windows (except for emergency updates, such as critical security patches, which may be released and installed at other times).
Q: What action is needed to receive updates for the WorkSpaces service?
No action is needed on your part. Updates are delivered automatically to your WorkSpaces during the maintenance window. During the maintenance window, your WorkSpaces may not be available.
Q: Can I turn off the software updates for the WorkSpaces service?
No. The WorkSpaces service requires these updates to be provided to ensure normal operation of your users’ WorkSpaces.
Q: I don’t want to have Windows Update automatically update my WorkSpaces. How can I control updates and ensure they are tested in advance?
You have full control over the Windows Update configuration in your WorkSpaces, and can use Active Directory Group Policy to configure this to meet your exact requirements. If you would like to have advance notice of patches so you can plan appropriately we recommend you refer to Microsoft Security Bulletin Advance Notification for more information.
Q: How are updates for applications installed in my WorkSpaces provided?
For all other applications, updates can be delivered via the automatic update service for each application if one is available. For applications without an automatic update service, you will need to evaluate the software vendor’s recommended updating approach and follow that if necessary.
Q: How can WorkSpaces be managed?
The WorkSpaces Management console lets you provision, reboot, rebuild, and delete WorkSpaces. To manage the underlying OS for the WorkSpaces, you can use standard Microsoft Active Directory tools such as Group Policy to manage the WorkSpaces. In the case when you have integrated WorkSpaces with an existing Active Directory domain, you can manage your WorkSpaces using the same tools and techniques you are using for your existing on-premises desktops. If you have not integrated with an existing Active Directory, you can set up a Directory Administration WorkSpace to perform management tasks. Please see the documentation for more information.
Q: What is the difference between rebooting and rebuilding a WorkSpace?
A reboot is just the same as a regular operating system (OS) reboot. A rebuild will retain the user volume on the WorkSpace (D:) but will return the WorkSpace to its original state (any changes made to the system drive (C:) will not be retained).
Q: How do I remove a WorkSpace I no longer require?
To remove a WorkSpace you no longer require, you can “delete” the Workspace. This will remove the underlying instance supporting the WorkSpace and the WorkSpace will no longer exist. Deleting a WorkSpace will also remove any data stored on the volumes attached to the WorkSpace, so please confirm you have saved any data you must keep prior to deleting a WorkSpace.
Q: Can I provide more than one Workspace per user?
No. You can currently only provide one WorkSpace for each user.
Q: How many Workspaces can I launch?
While there is no practical limit to the number of Workspaces, we have a default limit of up to 20 Workspaces per AWS account per region. New AWS accounts may start with limits that are lower than the limits described here. You can raise this limit by following these instructions to contact AWS.
Q: Is there a minimum number of Workspaces/Users I must provision?
No. There is no minimum requirement.
Q: What is the maximum network latency recommended while accessing a Workspace?
While the remoting protocol has a maximum round trip latency recommendation of 250 ms, the best user experience will be achieved at less than 100 ms.
Q: Does WorkSpaces need any Quality of Service configurations to be updated on my network?
If you wish to implement Quality of Service on your network for WorkSpaces traffic, you should prioritize WorkSpaces’ interactive video stream which is comprised of real time traffic on UDP port 4172. If possible, this traffic should be prioritized just after VoIP to provide the best user experience.
Q: Which AWS regions will WorkSpaces be offered in?
Amazon WorkSpaces is currently available in the US East (Virginia), US West (Oregon), EU (Ireland), Asia Pacific (Sydney), and Asia Pacific (Tokyo) AWS regions. You can always find out which services are available in each region by visiting the Products and Services by Region page.
Q: Is MFA on WorkSpaces available in my region?
Support for MFA is available in all AWS Regions where Amazon WorkSpaces is offered.
Q: How do I get support with WorkSpaces?
Q: How do I pay for WorkSpaces?
WorkSpaces are priced on a monthly subscription basis. You pay a monthly fee for each WorkSpace you launch. The monthly fee for Workspaces includes use of both the infrastructure (compute, storage, and bandwidth for streaming the desktop experience to the user) and the software applications listed in the bundle. In the first month a WorkSpace is active, the charges for the WorkSpace are prorated to the remainder of the month. For example, if a WorkSpace is started on the 10th of January, you will only be charged for the remaining 21 days in the month (31 – 10 = 21).
Q: How much does a WorkSpace cost?
Please see our pricing page for the latest information.
Q: Does WorkSpaces pricing include bandwidth costs?
The monthly subscription includes the streaming bandwidth between the user’s client and a WorkSpace. Web traffic from the user’s WorkSpaces (accessing public Internet, downloading files etc.) will be charged separately as AWS outbound bandwidth on your bill.
Q: Will there be a charge for downloading WorkSpaces client applications?
The WorkSpaces client applications are provided at no additional cost, and you can install the clients on as many devices as you need to.
Q: Can I use an HTTPS proxy to connect to my WorkSpaces?
Yes, you can configure a WorkSpaces Client app to use an HTTPS proxy. Please see our documentation for more information.
Q: Can I connect WorkSpaces to my VPC?
Yes. The first time you connect to the WorkSpaces Management Console, you can choose an easy ‘getting started’ link that will create a new VPC and two associated subnets for you as well as an Internet Gateway and a directory to contain your users. If you choose to access the console directly, you can choose which of your VPCs your WorkSpaces will connect to. If you have a VPC with a VPN connection back to your on-premises network, then your WorkSpaces will be able to communicate with your on-premises network (you retain the usual control you have over network access within your VPC using all of the normal configuration options such as security groups, network ACLS, and routing tables).
Q: Can I connect to my existing Active Directory with my WorkSpaces?
Yes. You can use WorkSpaces Connect to integrate with your existing Active Directory. When you do this, users can use their existing Active Directory credentials to connect to their WorkSpaces, and the WorkSpaces you launch will join your existing Active Directory. This means you can manage them with the same tools you’re used to using for managing other computers in your organization.
Q: Will my WorkSpaces be able to connect to the Internet to browse websites, download applications, etc?
Yes. You have full control over how your WorkSpaces connect to the Internet based on regular VPC configuration. Depending on what your requirements are you can either deploy a NAT instance for Internet access, assign an Elastic IP Address (EIP) to the Elastic Network Interface (ENI) associated with the WorkSpace, or your WorkSpaces can access the Internet by utilizing the connection back to your on-premises network.
Q: Can my WorkSpaces connect to my applications that are running in Amazon EC2 such as a file server?
Yes. Your WorkSpaces can connect to applications such as a fileserver running in Amazon EC2 (both “Classic” and VPC networking environments). All you need to do is ensure appropriate route table entries, security groups and network ACLs are configured so that the WorkSpaces can reach the EC2 resources you would like them to be able to connect to.
Q: What are the pre-requisites for enabling MFA on WorkSpaces?
To enable MFA on WorkSpaces, you will need to configure WorkSpaces Connect, and have an on-premises RADIUS server(s). Your on-premises network must allow inbound traffic over the default RADIUS server port (1812) from the WorkSpaces Connect server(s). Additionally, you must ensure that usernames match between Active Directory and your RADIUS server. To learn more, visit our documention.
Q: Do I need to set-up a directory to use the WorkSpaces service?
Each user you provision a WorkSpace for needs to exist in a directory, but you do not have to provision a directory yourself. You can either have the WorkSpaces service create and manage a directory for you and have users in that directory created when you provision a WorkSpace. Alternatively, you can integrate WorkSpaces with an existing, on-premises Active Directory so that users can continue to use their existing credentials meaning that they can get seamless applications to existing applications. When you integrate with an existing Active Directory, this also means that the WorkSpaces join one of your Active Directory domains, so that you can manage them with the same tools you use to manage other computers in your directory.
Q: If I use a directory that the WorkSpaces service creates for me, can I configure or customize it?
Yes. Please see our documentation for more details.
Q: Can I apply Active Directory policies to my WorkSpaces using the directory that the WorkSpaces service creates for me?
Yes. Please see our documentation for more details.
Q: How can I integrate with an existing Active Directory?
You can integrate with an existing Active Directory by using the WorkSpaces Connect feature. To enable integration you need to ensure that your domain is reachable via an Amazon Virtual Private Cloud VPC (this could mean that Active Directory domain controllers for your domain are running on Amazon EC2 instances, or that they are reachable via a VPN connection and are located in your on-premises network). You provide configuration information to the WorkSpaces service such as DNS server IP addresses, domain names, and an account with sufficient permissions to create computer accounts in your Active Directory domain. Once you’ve configured this integration, when you launch a WorkSpace, you can select which users you would like to provide a WorkSpace to from a list of users in your domain. When the WorkSpaces for these users are launched, the WorkSpaces will join your Active Directory domain, and your users will be able to connect to them using their existing Active Directory credentials. Detailed instructions for using WorkSpaces Connect are here.
Q: What happens to my WorkSpaces Connect or Cloud Directory when I remove all of my WorkSpaces?
We recommend deleting your WorkSpaces Connect or Cloud Directory, after you remove all of your WorkSpaces. You can complete this action on the Directories tab of the Amazon WorkSpaces console. If there are no WorkSpaces within your WorkSpaces Connect or Cloud Directory for 30 consecutive days, we may shut down these unused resources. You can create a new WorkSpaces Connect or Cloud Directory when you want to start using WorkSpaces again.
Q: Can I print to a local printer from my WorkSpace?
From your WorkSpace, you can print to a printer that is configured on your PC, including locally attached or network printers. Mac OS X is not currently supported for local printing.
Q: How do I print to my local printer?
To print from your WorkSpace to your local printer, select your local printer from the print menu, and select print.
Q: Why can’t I see my local printer from the printing menu?
Most printers are already supported by Amazon WorkSpaces. If your printer is not recognized, you may need to install the appropriate device driver on your WorkSpace.
Q: Can I use my WorkSpace with a cloud printing service?
You can use cloud printing solutions with your WorkSpace including, but not limited to, Cortado ThinPrint,® and Google Cloud Print.
Q: Can I print to a local printer from my tablet?
Printing locally from tablets is not currently supported.