Amazon WorkSpaces - Introduction

Learn to deploy a Windows 10 workspace in the Sydney region using the Amazon WorkSpaces quick setup, provision a Simple Add directory, and test a proof of concept.

Explore the basics of Amazon WorkSpaces directories, covering authentication options, AD domain settings, security groups, and IP access controls. Understand how to manage access, maintenance mode, and user self-service features.

Explore the high level architecture of amazon workspaces, including ssl login, authentication gateway, ad connector with on premises active directory, and dual-homed streaming over dcv and port 443.

Explore IP access controls for Amazon WorkSpaces and how a directory-bound group acts as a virtual firewall, restricting logins to approved IP addresses or CIDR ranges.

Analyze Amazon WorkSpaces performance with CloudWatch metrics and automatic dashboards to monitor availability, latency, connection health, and set alarms.

Learn how to create and snapshot a custom Amazon WorkSpaces image, match it to a specific instance type, and bundle it for automated deployment, while following essential prerequisites.

Install chrome enterprise on a workspaces image and run updates. Capture the image with the image checker and deploy a workspace from this custom image using bundles.

Deploy a custom Amazon WorkSpaces image bundle, log in with a registration code, and verify Chrome, Firefox, and Edge are installed, using on-prem scripts to create a consistent image.

Create a workspaces pool with a dedicated directory, configure Saml 2.0 with Okta, enable private networking, non-persistent sessions, and optional persistence settings.

Create a secure browser portal in a dedicated VPC, configure Okta SAML 2.0 single sign-on, and apply Chrome policy settings for controlled browser access with Amazon WorkSpaces.

Learn the basics of SAML and certificate-based authentication for Amazon WorkSpaces and AppStream, including passwordless access, identity providers, and step-by-step labs to implement and test.

Configure a VPC in your AWS account for Amazon WorkSpaces and AppStream, creating public and private subnets, NAT gateways, DNS, and VPC endpoints.

Launch a Windows 2022 EC2 instance, install Active Directory and Certificate Services, and configure it as a domain controller using Fleet Manager for remote access.

Install Active Directory Domain Services on an ec2 instance, promote it to a domain controller for a new forest, and configure Certificate Services as an enterprise root CA.

Design an Active Directory DNS design in AWS, comparing Route 53 with a conditional forwarder and outbound resolver to AD versus using a VPC DHCP option set.

Create an Active Directory connector to enable WorkSpaces to communicate with your AD on EC2, then register it with WorkSpaces and configure the right VPC, DNS name, and service account.

Provision an Amazon WorkSpaces personal workspace with Windows 2022, two vCPU, four GB RAM, auto stop after one hour, and connect to an Active Directory domain for user provisioning.

Retrieve the registration code from the workspaces console, download the client, register the workspace, and log in with domain credentials to an Active Directory joined workspace.

Configure Okta as the saml identity provider for Amazon WorkSpaces by setting relay state, name id format, and attribute statements for email and role to enable sign-in and test.

Configure AWS IAM with Okta based SAML federation to allow a defined app to assume a role and stream workspaces, using a SAML 2.0 provider and inline policy.

Finish configuring Okta Saml for Amazon WorkSpaces, including relay state, nameID format, and attribute statements. Assign the app to users, enable Saml on the WorkSpaces directory, and test.

Enable SAML 2.0 authentication for AWS WorkSpaces by configuring the chosen Okta app, linking its sign-on URL, enforcing SAML in the Sydney directory, and testing the SAML flow.

Sign in with Okta to the Amazon WorkSpaces app using your Active Directory credentials and complete the SAML single sign-on flow, validating browser-based authentication and centralized access control.

Configure certificate based authentication for Amazon WorkSpaces by linking an S3 bucket and CloudFront with a subordinate CA, private CA, Enterprise Active Directory certificate services, then test SAML and CBA.

Configure certificate based authentication for Amazon WorkSpaces by updating Okta SAML settings, adding required attributes like WSP_sed, and mapping Okta attributes through directory integrations for provisioning.

Configure prerequisites for certificate based authentication by creating a restricted S3 bucket for CRL, linking CloudFront, and applying an OAC policy; then create and enroll a private subordinate CA.

Convert downloaded certificates into a subordinate PEM file using OpenSSL, import into a subordinate CA and Active Directory, publish the certificate, and enable certificate-based authentication in WorkSpaces.

Log in as an end user to launch the workspaces app with SAML and certificate-based authentication, using the default browser to sign in and launch the session without credential prompts.