Controlling Access to Amazon WorkSpaces Resources

By default, IAM users don't have permissions for Amazon WorkSpaces resources and operations. To allow IAM users to manage Amazon WorkSpaces resources, you must create an IAM policy that explicitly grants them permissions, and attach the policy to the IAM users or groups that require those permissions. For more information about IAM policies, see Permissions and Policies in the IAM User Guide guide.

Amazon WorkSpaces also creates an IAM role to allow the Amazon WorkSpaces service access to required resources.

For more information about IAM, see Identity and Access Management (IAM) and the IAM User Guide.

Example 1: Perform all Amazon WorkSpaces tasks

The following policy statement grants an IAM user permission to perform all Amazon WorkSpaces tasks, including creating and managing directories, as well as running the quick setup procedure.

Note that although Amazon WorkSpaces fully supports the Action and Resource elements when using the API and command-line tools, you must set them both to "*" in order to use the Amazon WorkSpaces console successfully.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "workspaces:*",
        "ds:*",
        "iam:PassRole", 
        "iam:GetRole", 
        "iam:CreateRole", 
        "iam:PutRolePolicy", 
        "kms:ListAliases",
        "kms:ListKeys",
        "ec2:CreateVpc", 
        "ec2:CreateSubnet", 
        "ec2:CreateNetworkInterface", 
        "ec2:CreateInternetGateway", 
        "ec2:CreateRouteTable", 
        "ec2:CreateRoute", 
        "ec2:CreateTags", 
        "ec2:CreateSecurityGroup", 
        "ec2:DescribeInternetGateways", 
        "ec2:DescribeRouteTables", 
        "ec2:DescribeVpcs", 
        "ec2:DescribeSubnets", 
        "ec2:DescribeNetworkInterfaces", 
        "ec2:DescribeAvailabilityZones", 
        "ec2:AttachInternetGateway", 
        "ec2:AssociateRouteTable", 
        "ec2:AuthorizeSecurityGroupEgress", 
        "ec2:AuthorizeSecurityGroupIngress", 
        "ec2:DeleteSecurityGroup", 
        "ec2:DeleteNetworkInterface", 
        "ec2:RevokeSecurityGroupEgress", 
        "ec2:RevokeSecurityGroupIngress",
        "workdocs:RegisterDirectory",
        "workdocs:DeregisterDirectory",
        "workdocs:AddUserToGroup",
        "workdocs:RemoveUserFromGroup"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

Example 2: Perform WorkSpace-specific tasks

The following policy statement grants an IAM user permission to perform only WorkSpace-specific tasks, such as launching and removing WorkSpaces. These permissions do not allow the user to manage directories or run the quick setup procedure.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "workspaces:*",
        "ds:*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

To also grant the user the ability to enable Amazon WorkDocs for users within Amazon WorkSpaces, add the workdocs operations shown here:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "workspaces:*",
        "ds:*",
        "workdocs:AddUserToGroup",
        "workdocs:RemoveUserFromGroup"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

To also grant the user the ability to use the Launch Workspaces wizard, add the kms operations shown here:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "workspaces:*",
        "ds:*",
        "workdocs:AddUserToGroup",
        "workdocs:RemoveUserFromGroup",
        "kms:ListAliases",
        "kms:ListKeys"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

Specifying Amazon WorkSpaces Resources in an IAM Policy

To specify an Amazon WorkSpaces resource in the Resource element of the policy statement, you need to use the Amazon Resource Name (ARN) of the resource. You control access to your Amazon WorkSpaces resources by either allowing or denying permissions to use the API actions specified in the Action element of your IAM policy statement. Amazon WorkSpaces defines ARNs for WorkSpaces and bundles.

WorkSpace ARN

A WorkSpace ARN has the following syntax:

arn:aws:workspaces:region:account_id:workspace/workspace_identifier

region: The region that the WorkSpace is in.
account_id: The AWS account ID, with no hyphens, such as 123456789012.
workspace_identifier: The identifier of the WorkSpace, such as ws-0123456789.

The following is the format of the Resource element of a policy statement that identifies a specific WorkSpace:

"Resource":"arn:aws:workspaces:region:account_id:workspace/workspace_identifier"

You can use the * wildcard to specify all WorkSpaces that belong to a specific account in a specific region.

Bundle ARN

A bundle ARN has the following syntax:

arn:aws:workspaces:region:account_id:workspacebundle/bundle_identifier

region: The region that the WorkSpace is in.
account_id: The AWS account ID, with no hyphens, such as 123456789012.
bundle_identifier: The identifier of the WorkSpace bundle, such as wsb-0123456789.

The following is the format of the Resource element of a policy statement that identifies a specific bundle:

"Resource":"arn:aws:workspaces:region:account_id:workspacebundle/bundle_identifier"

You can use the * wildcard to specify all bundles that belong to a specific account in a specific region.

Document Conventions

« Previous Next »