Example policies Specify WorkSpaces resources in an IAM policy Create the workspaces_DefaultRole Role Create the AmazonWorkSpacesPCAAccess service role

Identity and access management for WorkSpaces

By default, IAM users don't have permissions for WorkSpaces resources and operations. To allow IAM users to manage WorkSpaces resources, you must create an IAM policy that explicitly grants them permissions, and attach the policy to the IAM users or groups that require those permissions.

To provide access, add permissions to your users, groups, or roles:

Users and groups in AWS IAM Identity Center (successor to AWS Single Sign-On):

Create a permission set. Follow the instructions in Create a permission set in the AWS IAM Identity Center (successor to AWS Single Sign-On) User Guide.
Users managed in IAM through an identity provider:

Create a role for identity federation. Follow the instructions in Creating a role for a third-party identity provider (federation) in the IAM User Guide.
IAM users:
- Create a role that your user can assume. Follow the instructions in Creating a role for an IAM user in the IAM User Guide.
- (Not recommended) Attach a policy directly to a user or add a user to a user group. Follow the instructions in Adding permissions to a user (console) in the IAM User Guide.

For more information about IAM policies, see Policies and Permissions in the IAM User Guide guide.

WorkSpaces also creates an IAM role, workspaces_DefaultRole, which allows the WorkSpaces service access to required resources.

For more information about IAM, see Identity and Access Management (IAM) and the IAM User Guide. You can find the WorkSpaces-specific resources, actions, and condition context keys for use in IAM permission policies at Actions, Resources, and Condition Keys for Amazon WorkSpaces in the IAM User Guide.

For a tool that helps you create IAM policies, see the AWS Policy Generator. You can also use the IAM Policy Simulator to test whether a policy would allow or deny a specific request to AWS.

Note

Amazon WorkSpaces doesn’t support the provisioning of IAM credentials into a WorkSpace (such as with an instance profile).

Example policies
Specify WorkSpaces resources in an IAM policy
Create the workspaces_DefaultRole Role
Create the AmazonWorkSpacesPCAAccess service role
AWS managed policies for WorkSpaces

Example policies

The following examples show policy statements that you could use to control the permissions that IAM users have to Amazon WorkSpaces.

Example 1: Perform all WorkSpaces tasks

The following policy statement grants an IAM user permission to perform all WorkSpaces tasks, including creating and managing directories. It also grants permission to run the quick setup procedure.

Although Amazon WorkSpaces fully supports the Action and Resource elements when using the API and command line tools, to use Amazon WorkSpaces from the AWS Management Console, an IAM user must have permissions for the following actions and resources:

Actions: "workspaces:*" and "ds:*"
Resources: "Resource": "*"

The following example policy shows how to allow an IAM user to use Amazon WorkSpaces from the AWS Management Console.


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "workspaces:*",
        "ds:*",
        "iam:GetRole",
        "iam:CreateRole",
        "iam:PutRolePolicy",
        "iam:CreatePolicy",
        "iam:AttachRolePolicy",
        "iam:ListRoles",
        "kms:ListAliases",
        "kms:ListKeys",
        "ec2:CreateVpc",
        "ec2:CreateSubnet",
        "ec2:CreateNetworkInterface",
        "ec2:CreateInternetGateway",
        "ec2:CreateRouteTable",
        "ec2:CreateRoute",
        "ec2:CreateTags",
        "ec2:CreateSecurityGroup",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeRouteTables",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeAvailabilityZones",
        "ec2:AttachInternetGateway",
        "ec2:AssociateRouteTable",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:DeleteSecurityGroup",
        "ec2:DeleteNetworkInterface",
        "ec2:RevokeSecurityGroupEgress",
        "ec2:RevokeSecurityGroupIngress",
        "workdocs:RegisterDirectory",
        "workdocs:DeregisterDirectory",
        "workdocs:AddUserToGroup"
      ],
      "Resource": "*"
    },
    {
      "Sid": "iamPassRole",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "workspaces.amazonaws.com"
        }
      }
    }
  ]
}

Example 2: Perform WorkSpace-specific tasks

The following policy statement grants an IAM user permission to perform WorkSpace-specific tasks, such as launching and removing WorkSpaces. In the policy statement, the ds:* action grants broad permissions — full control over all Directory Services objects in the account.


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "workspaces:*",
        "ds:*",
        "iam:PutRolePolicy"
      ],
      "Resource": "*"
    }
  ]
}

To also grant the user the ability to enable Amazon WorkDocs for users within WorkSpaces, add the workdocs operation shown in the following example.


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "workspaces:*",
        "ds:*",
        "workdocs:AddUserToGroup"
      ],
      "Resource": "*"
    }
  ]
}

To also grant the user the ability to use the Launch WorkSpaces wizard, add the kms operations as shown in the following example.


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "workspaces:*",
        "ds:*",
        "workdocs:AddUserToGroup",
        "kms:ListAliases",
        "kms:ListKeys"
      ],
      "Resource": "*"
    }
  ]
}

Example 3: Perform all WorkSpaces tasks for BYOL WorkSpaces

The following policy statement grants an IAM user permission to perform all WorkSpaces tasks, including those Amazon EC2 tasks necessary for creating Bring Your Own License (BYOL) WorkSpaces.


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "workspaces:*",
        "ds:*",
        "iam:GetRole",
        "iam:CreateRole",
        "iam:PutRolePolicy",
        "kms:ListAliases",
        "kms:ListKeys",
        "ec2:CreateVpc",
        "ec2:CreateSubnet",
        "ec2:CreateNetworkInterface",
        "ec2:CreateInternetGateway",
        "ec2:CreateRouteTable",
        "ec2:CreateRoute",
        "ec2:CreateTags",
        "ec2:CreateSecurityGroup",
        "ec2:DescribeImages",
        "ec2:ModifyImageAttribute",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeRouteTables",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeAvailabilityZones",
        "ec2:AttachInternetGateway",
        "ec2:AssociateRouteTable",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:DeleteSecurityGroup",
        "ec2:DeleteNetworkInterface",
        "ec2:RevokeSecurityGroupEgress",
        "ec2:RevokeSecurityGroupIngress",
        "workdocs:RegisterDirectory",
        "workdocs:DeregisterDirectory",
        "workdocs:AddUserToGroup"
      ],
      "Resource": "*"
    },
    {
      "Sid": "iamPassRole",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "workspaces.amazonaws.com"
        }
      }
    }
  ]
}

Specify WorkSpaces resources in an IAM policy

To specify an WorkSpaces resource in the Resource element of the policy statement, use the Amazon Resource Name (ARN) of the resource. You control access to your WorkSpaces resources by either allowing or denying permissions to use the API actions that are specified in the Action element of your IAM policy statement. WorkSpaces defines ARNs for WorkSpaces, bundles, IP groups, and directories.

WorkSpace ARN

A WorkSpace ARN has the syntax shown in the following example.


arn:aws:workspaces:region:account_id:workspace/workspace_identifier

region: The Region that the WorkSpace is in (for example, us-east-1).
account_id: The ID of the AWS account, with no hyphens (for example, 123456789012).
workspace_identifier: The ID of the WorkSpace (for example, ws-a1bcd2efg).

The following is the format of the Resource element of a policy statement that identifies a specific WorkSpace.


"Resource": "arn:aws:workspaces:region:account_id:workspace/workspace_identifier"

You can use the * wildcard to specify all WorkSpaces that belong to a specific account in a specific Region.

Image ARN

A WorkSpace image ARN has the syntax shown in the following example.


arn:aws:workspaces:region:account_id:workspaceimage/image_identifier

region: The Region that the WorkSpace image is in (for example, us-east-1).
account_id: The ID of the AWS account, with no hyphens (for example, 123456789012).
bundle_identifier: The ID of the WorkSpace image (for example, wsi-a1bcd2efg).

The following is the format of the Resource element of a policy statement that identifies a specific image.


"Resource": "arn:aws:workspaces:region:account_id:workspaceimage/image_identifier"

You can use the * wildcard to specify all images that belong to a specific account in a specific Region.

Bundle ARN

A bundle ARN has the syntax shown in the following example.


arn:aws:workspaces:region:account_id:workspacebundle/bundle_identifier

region: The Region that the WorkSpace is in (for example, us-east-1).
account_id: The ID of the AWS account, with no hyphens (for example, 123456789012).
bundle_identifier: The ID of the WorkSpace bundle (for example, wsb-a1bcd2efg).

The following is the format of the Resource element of a policy statement that identifies a specific bundle.


"Resource": "arn:aws:workspaces:region:account_id:workspacebundle/bundle_identifier"

You can use the * wildcard to specify all bundles that belong to a specific account in a specific Region.

IP Group ARN

An IP group ARN has the syntax shown in the following example.


arn:aws:workspaces:region:account_id:workspaceipgroup/ipgroup_identifier

region: The Region that the WorkSpace is in (for example, us-east-1).
account_id: The ID of the AWS account, with no hyphens (for example, 123456789012).
ipgroup_identifier: The ID of the IP group (for example, wsipg-a1bcd2efg).

The following is the format of the Resource element of a policy statement that identifies a specific IP group.


"Resource": "arn:aws:workspaces:region:account_id:workspaceipgroup/ipgroup_identifier"

You can use the * wildcard to specify all IP groups that belong to a specific account in a specific Region.

Directory ARN

A directory ARN has the syntax shown in the following example.


arn:aws:workspaces:region:account_id:directory/directory_identifier

region: The Region that the WorkSpace is in (for example, us-east-1).
account_id: The ID of the AWS account, with no hyphens (for example, 123456789012).
directory_identifier: The ID of the directory (for example, d-12345a67b8).

The following is the format of the Resource element of a policy statement that identifies a specific directory.


"Resource": "arn:aws:workspaces:region:account_id:directory/directory_identifier"

You can use the * wildcard to specify all directories that belong to a specific account in a specific Region.

Connection alias ARN

A connection alias ARN has the syntax shown in the following example.


arn:aws:workspaces:region:account_id:connectionalias/connectionalias_identifier

region: The Region that the connection alias is in (for example, us-east-1).
account_id: The ID of the AWS account, with no hyphens (for example, 123456789012).
connectionalias_identifier: The ID of the connection alias (for example, wsca-12345a67b8).

The following is the format of the Resource element of a policy statement that identifies a specific connection alias.


"Resource": "arn:aws:workspaces:region:account_id:connectionalias/connectionalias_identifier"

You can use the * wildcard to specify all connection aliases that belong to a specific account in a specific Region.

API actions with no support for resource-level permissions

You can't specify a resource ARN with the following API actions:

AssociateIpGroups
CreateIpGroup
CreateTags
DeleteTags
DeleteWorkspaceImage
DescribeAccount
DescribeAccountModifications
DescribeIpGroups
DescribeTags
DescribeWorkspaceDirectories
DescribeWorkspaceImages
DescribeWorkspaces
DescribeWorkspacesConnectionStatus
DisassociateIpGroups
ImportWorkspaceImage
ListAvailableManagementCidrRanges
ModifyAccount

For API actions that don't support resource-level permissions, you must specify the resource statement shown in the following example.


"Resource": "*"

API actions that don't support account-level restrictions on shared resources

For the following API actions, you can't specify an account ID in the resource ARN when the resource isn't owned by the account:

AssociateConnectionAlias
CopyWorkspaceImage
DisassociateConnectionAlias

For these API actions, you can specify an account ID in the resource ARN only when that account owns the resources to be acted upon. When the account doesn't own the resources, you must specify * for the account ID, as shown in the following example.


"arn:aws:workspaces:region:*:resource_type/resource_identifier"

Create the workspaces_DefaultRole Role

Before you can register a directory using the API, you must verify that a role named workspaces_DefaultRole exists. This role is created by the Quick Setup or if you launch a WorkSpace using the AWS Management Console, and it grants Amazon WorkSpaces permission to access specific AWS resources on your behalf. If this role does not exist, you can create it using the following procedure.

To create the workspaces_DefaultRole role

Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
In the navigation pane on the left, choose Roles.
Choose Create role.
Under Select type of trusted entity, choose Another AWS account.
For Account ID, enter your account ID with no hyphens or spaces.
For Options, do not specify multi-factor authentication (MFA).
Choose Next: Permissions.
On the Attach permissions policies page, select the AWS managed policies AmazonWorkSpacesServiceAccess and AmazonWorkSpacesSelfServiceAccess.
Under Set permissions boundary, we recommend that you not use a permissions boundary because of the potential for conflicts with the policies that are attached to this role. Such conflicts could block certain necessary permissions for the role.
Choose Next: Tags.
On the Add tags (optional) page, add tags if needed.
Choose Next: Review.
On the Review page, for Role name, enter workspaces_DefaultRole.
(Optional) For Role description, enter a description.
Choose Create Role.
On the Summary page for the workspaces_DefaultRole role, choose the Trust relationships tab.
On the Trust relationships tab, choose Edit trust relationship.

On the Edit Trust Relationship page, replace the existing policy statement with the following statement.


{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "workspaces.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Choose Update Trust Policy.

Create the AmazonWorkSpacesPCAAccess service role

Before users can login using certificate-based authentication, you must verify that a role named AmazonWorkSpacesPCAAccess exists. This role is created when you enable certificate-based authentication on a Directory using the AWS Management Console, and it grants Amazon WorkSpaces permission to access AWS Private CA resources on your behalf. If this role does not exist because you are not using the console to manage certificate-based authentication, you can create it using the following procedure.

To create the AmazonWorkSpacesPCAAccess service role using the AWS CLI

Create a JSON file named AmazonWorkSpacesPCAAccess.json with the following text.


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "prod.euc.ecm.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Adjust the AmazonWorkSpacesPCAAccess.json path as needed and run the following AWS CLI commands to create the service role and attach the AmazonWorkspacesPCAAccess managed policy.


aws iam create-role --path /service-role/ --role-name AmazonWorkSpacesPCAAccess --assume-role-policy-document file://AmazonWorkSpacesPCAAccess.json


aws iam attach-role-policy —role-name AmazonWorkSpacesPCAAccess —policy-arn arn:aws:iam::aws:policy/AmazonWorkspacesPCAAccess

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Data protection

AWS managed policies for WorkSpaces