AWS managed policies for WorkSpaces - Amazon WorkSpaces

AWS managed policies for WorkSpaces

Using AWS managed policies makes adding permissions to users, groups, and roles easier than writing policies yourself. It takes time and expertise to create IAM customer managed policies that provide your team with only the permissions they need. Use AWS managed policies to get started quickly. These policies cover common use cases and are available in your AWS account. For more information about AWS managed policies, see AWS managed policies in the IAM User Guide.

AWS services maintain and update AWS managed policies. You can't change the permissions in AWS managed policies. Services may occasionally add additional permissions to an AWS managed policy to support new features. This type of update affects all identities (users, groups, and roles) where the policy is attached. Services are most likely to update an AWS managed policy when a new feature is launched or when new operations become available. Services don't remove permissions from an AWS managed policy, so policy updates won't break your existing permissions.

Additionally, AWS supports managed policies for job functions that span multiple services. For example, the ReadOnlyAccess AWS managed policy provides read-only access to all AWS services and resources. When a service launches a new feature, AWS adds read-only permissions for new operations and resources. For a list and descriptions of job function policies, see AWS managed policies for job functions in the IAM User Guide.

AWS managed policy: AmazonWorkSpacesAdmin

This policy provides access to Amazon WorkSpaces administrative actions. It provides the following permissions:

  • workspaces - Allows access to perform administrative actions on WorkSpaces resources.

  • kms - Allows access to list and describe KMS keys, as well as list aliases.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "workspaces:CreateTags", "workspaces:CreateWorkspaces", "workspaces:CreateWorkspaceImage", "workspaces:DeleteTags", "workspaces:DescribeTags", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspacesConnectionStatus", "workspaces:ModifyWorkspaceProperties", "workspaces:ModifySamlProperties", "workspaces:RebootWorkspaces", "workspaces:RebuildWorkspaces", "workspaces:StartWorkspaces", "workspaces:StopWorkspaces", "workspaces:TerminateWorkspaces" ], "Resource": "*" } ] }

AWS managed policy: AmazonWorkSpacesServiceAccess

This policy provides customer account access to the Amazon WorkSpaces service for launching a WorkSpace. It is included in the workspaces_DefaultRole role, and it provides the following permissions:

  • ec2 - Allows access to manage Amazon EC2 resources associated with a WorkSpace, such as network interfaces.

{ "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces" ], "Effect": "Allow", "Resource": "*" } ] }

AWS managed policy: AmazonWorkSpacesSelfServiceAccess

This policy provides access to the Amazon WorkSpaces service to perform WorkSpaces self-service actions initiated by a user. It is included in the workspaces_DefaultRole role, and it provides the following permissions:

  • workspaces - Allows access to self-service WorkSpaces management capabilities for users.

{ "Version": "2012-10-17", "Statement": [ { "Action": [ "workspaces:RebootWorkspaces", "workspaces:RebuildWorkspaces", "workspaces:ModifyWorkspaceProperties" ], "Effect": "Allow", "Resource": "*" } ] }

AWS managed policy: AmazonWorkSpacesServiceAccess

This policy provides customer account access to the Amazon WorkSpaces service for launching a WorkSpace. It is included in the workspaces_DefaultRole role, and it provides the following permissions:

  • ec2 - Allows access to manage Amazon EC2 resources associated with a WorkSpace, such as network interfaces.

{ "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces" ], "Effect": "Allow", "Resource": "*" } ] }

AWS managed policy: AmazonWorkspacesPCAAccess

This managed policy provides access to AWS Certificate Manager Private Certificate Authority (Private CA) resources in your AWS account for certificate-based authentication. It is included in the AmazonWorkSpacesPCAAccess role, and it provides the following permissions:

  • acm-pca - Allows access to AWS Private CA to manage certificate-based authentication.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate", "acm-pca:GetCertificate", "acm-pca:DescribeCertificateAuthority" ], "Resource": "arn:*:acm-pca:*:*:*", "Condition": { "StringLike": { "aws:ResourceTag/euc-private-ca": "*" } } } ] }

WorkSpaces updates to AWS managed policies

View details about updates to AWS managed policies for WorkSpaces since this service began tracking these changes.

Change Description Date
AWS managed policy: AmazonWorkspacesPCAAccess - Added new policy WorkSpaces added a new managed policy to grant acm-pca permission to manage AWS Private CA to manage certificate-based authentication. November 18, 2022
WorkSpaces started tracking changes WorkSpaces started tracking changes for its WorkSpaces managed policies. March 1, 2021