Menu
Amazon WorkSpaces
Administration Guide

Control Access to Amazon WorkSpaces Resources

By default, IAM users don't have permissions for Amazon WorkSpaces resources and operations. To allow IAM users to manage Amazon WorkSpaces resources, you must create an IAM policy that explicitly grants them permissions, and attach the policy to the IAM users or groups that require those permissions. For more information about IAM policies, see Permissions and Policies in the IAM User Guide guide.

Amazon WorkSpaces also creates an IAM role to allow the Amazon WorkSpaces service access to required resources.

For more information about IAM, see Identity and Access Management (IAM) and the IAM User Guide.

Example 1: Perform all Amazon WorkSpaces tasks

The following policy statement grants an IAM user permission to perform all Amazon WorkSpaces tasks, including creating and managing directories, as well as running the quick setup procedure.

Note that although Amazon WorkSpaces fully supports the Action and Resource elements when using the API and command-line tools, you must set them both to "*" in order to use the Amazon WorkSpaces console successfully.

Copy
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "workspaces:*", "ds:*", "iam:PassRole", "iam:GetRole", "iam:CreateRole", "iam:PutRolePolicy", "kms:ListAliases", "kms:ListKeys", "ec2:CreateVpc", "ec2:CreateSubnet", "ec2:CreateNetworkInterface", "ec2:CreateInternetGateway", "ec2:CreateRouteTable", "ec2:CreateRoute", "ec2:CreateTags", "ec2:CreateSecurityGroup", "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAvailabilityZones", "ec2:AttachInternetGateway", "ec2:AssociateRouteTable", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "workdocs:RegisterDirectory", "workdocs:DeregisterDirectory", "workdocs:AddUserToGroup", "workdocs:RemoveUserFromGroup" ], "Resource": "*" } ] }

Example 2: Perform WorkSpace-specific tasks

The following policy statement grants an IAM user permission to perform only WorkSpace-specific tasks, such as launching and removing WorkSpaces. These permissions do not allow the user to manage directories or run the quick setup procedure.

Copy
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "workspaces:*", "ds:*" ], "Resource": "*" } ] }

To also grant the user the ability to enable Amazon WorkDocs for users within Amazon WorkSpaces, add the workdocs operations shown here:

Copy
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "workspaces:*", "ds:*", "workdocs:AddUserToGroup", "workdocs:RemoveUserFromGroup" ], "Resource": "*" } ] }

To also grant the user the ability to use the Launch WorkSpaces wizard, add the kms operations shown here:

Copy
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "workspaces:*", "ds:*", "workdocs:AddUserToGroup", "workdocs:RemoveUserFromGroup", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] }

To grant the user the ability to perform WorkSpaces-specific tasks except for certificate tasks, add a statement to deny the certificate operations:

Copy
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "workspaces:*", "ds:*" ], "Resource": "*" }, { "Effect": "Deny", "Action": [ "workspaces:DeleteCertificate", "workspaces:ImportCertificate", "workspaces:DescribeCertificates" ], "Resource": "*" } ] }

Specifying Amazon WorkSpaces Resources in an IAM Policy

To specify an Amazon WorkSpaces resource in the Resource element of the policy statement, you need to use the Amazon Resource Name (ARN) of the resource. You control access to your Amazon WorkSpaces resources by either allowing or denying permissions to use the API actions specified in the Action element of your IAM policy statement. Amazon WorkSpaces defines ARNs for WorkSpaces and bundles.

WorkSpace ARN

A WorkSpace ARN has the following syntax:

arn:aws:workspaces:region:account_id:workspace/workspace_identifier
region

The region that the WorkSpace is in (for example, us-east-2).

account_id

The ID of the AWS account, with no hyphens (for example, 123456789012).

workspace_identifier

The ID of the WorkSpace (for example, ws-0123456789).

The following is the format of the Resource element of a policy statement that identifies a specific WorkSpace:

"Resource": "arn:aws:workspaces:region:account_id:workspace/workspace_identifier"

You can use the * wildcard to specify all WorkSpaces that belong to a specific account in a specific region.

Bundle ARN

A bundle ARN has the following syntax:

arn:aws:workspaces:region:account_id:workspacebundle/bundle_identifier
region

The region that the WorkSpace is in (for example, us-east-2).

account_id

The ID of the AWS account, with no hyphens (for example, 123456789012).

bundle_identifier

The ID of the WorkSpace bundle (for example, wsb-0123456789).

The following is the format of the Resource element of a policy statement that identifies a specific bundle:

"Resource": "arn:aws:workspaces:region:account_id:workspacebundle/bundle_identifier"

You can use the * wildcard to specify all bundles that belong to a specific account in a specific region.