# Identity and access management for WorkSpaces
<a name="workspaces-access-control"></a>

By default, IAM users don't have permissions for WorkSpaces resources and operations. To allow IAM users to manage WorkSpaces resources, you must create an IAM policy that explicitly grants them permissions, and attach the policy to the IAM users or groups that require those permissions.

**Note**  
Amazon WorkSpaces doesn’t support the provisioning of IAM credentials into a WorkSpace (such as with an instance profile).

To provide access, add permissions to your users, groups, or roles:
+ Users and groups in AWS IAM Identity Center:

  Create a permission set. Follow the instructions in [Create a permission set](https://docs.aws.amazon.com//singlesignon/latest/userguide/howtocreatepermissionset.html) in the *AWS IAM Identity Center User Guide*.
+ Users managed in IAM through an identity provider:

  Create a role for identity federation. Follow the instructions in [Create a role for a third-party identity provider (federation)](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_roles_create_for-idp.html) in the *IAM User Guide*.
+ IAM users:
  + Create a role that your user can assume. Follow the instructions in [Create a role for an IAM user](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_roles_create_for-user.html) in the *IAM User Guide*.
  + (Not recommended) Attach a policy directly to a user or add a user to a user group. Follow the instructions in [Adding permissions to a user (console)](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_users_change-permissions.html#users_change_permissions-add-console) in the *IAM User Guide*.

Following are additional resources for IAM:
+ For more information about IAM policies, see [Policies and Permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *IAM User Guide* guide.
+ For more information about IAM, see [Identity and Access Management (IAM)](https://aws.amazon.com/iam) and the [https://docs.aws.amazon.com/IAM/latest/UserGuide/](https://docs.aws.amazon.com/IAM/latest/UserGuide/).
+ For more information about WorkSpaces-specific resources, actions, and condition context keys for use in IAM permission policies, see [Actions, Resources, and Condition Keys for Amazon WorkSpaces](https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonworkspaces.html) in the *IAM User Guide*.
+ For a tool that helps you create IAM policies, see the [AWS Policy Generator](https://aws.amazon.com/blogs/aws/aws-policy-generator/). You can also use the [IAM Policy Simulator](https://docs.aws.amazon.com/IAM/latest/UsingPolicySimulatorGuide/) to test whether a policy would allow or deny a specific request to AWS.

**Topics**
+ [

## Example policies
](#workspaces-example-iam-policies)
+ [

## Specify WorkSpaces resources in an IAM policy
](#wsp_iam_resource)
+ [

## Create the workspaces\$1DefaultRole Role
](#create-default-role)
+ [

## Create the AmazonWorkSpacesPCAAccess service role
](#create-pca-access-role)
+ [

# AWS managed policies for WorkSpaces
](managed-policies.md)
+ [

# Access to WorkSpaces and scripts on streaming instances
](using-iam-roles-to-grant-permissions-to-applications-scripts-streaming-instances.md)
+ [

# Amazon WorkSpaces Console operations permissions reference
](wsp-console-permissions-ref.md)

## Example policies
<a name="workspaces-example-iam-policies"></a>

The following examples show policy statements that you could use to control the permissions that IAM users have to Amazon WorkSpaces.

### Example 1: Grant access to perform WorkSpaces personal and pools tasks
<a name="perform-workspaces-personal-pools-tasks"></a>

The following policy statement grants an IAM user permission to perform WorkSpaces personal and pools tasks.

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:*",
                "workspaces:*",
                "application-autoscaling:DeleteScalingPolicy",
                "application-autoscaling:DeleteScheduledAction",
                "application-autoscaling:DeregisterScalableTarget",
                "application-autoscaling:DescribeScalableTargets",
                "application-autoscaling:DescribeScalingActivities",
                "application-autoscaling:DescribeScalingPolicies",
                "application-autoscaling:DescribeScheduledActions",
                "application-autoscaling:PutScalingPolicy",
                "application-autoscaling:PutScheduledAction",
                "application-autoscaling:RegisterScalableTarget",
                "cloudwatch:DeleteAlarms",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:PutMetricAlarm",
                "ec2:AssociateRouteTable",
                "ec2:AttachInternetGateway",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:CreateInternetGateway",
                "ec2:CreateNetworkInterface",
                "ec2:CreateRoute",
                "ec2:CreateRouteTable",
                "ec2:CreateSecurityGroup",
                "ec2:CreateSubnet",
                "ec2:CreateTags",
                "ec2:CreateVpc",
                "ec2:DeleteNetworkInterface",
                "ec2:DeleteSecurityGroup",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:RevokeSecurityGroupIngress",
                "iam:AttachRolePolicy",
                "iam:CreatePolicy",
                "iam:CreateRole",
                "iam:GetRole",
                "iam:ListRoles",
                "iam:PutRolePolicy",
                "kms:ListAliases",
                "kms:ListKeys",
                "secretsmanager:ListSecrets",
                "tag:GetResources",
                "sso-directory:SearchUsers",
                "sso:CreateApplication",
                "sso:DeleteApplication",
                "sso:DescribeApplication",
                "sso:DescribeInstance",
                "sso:GetApplicationGrant",
                "sso:ListInstances",
                
                "sso:PutApplicationAssignmentConfiguration",
                "sso:PutApplicationAuthenticationMethod",
                "sso:PutApplicationGrant"
            ],
            "Resource": "*"
        },
        {
            "Sid": "iamPassRole",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "workspaces.amazonaws.com"
                }
            }
        }
    ]
}
```

------

### Example 2: Grant access to perform WorkSpaces Personal tasks
<a name="perform-workspaces-personal-tasks"></a>

The following policy statement grants an IAM user permission to perform all WorkSpaces Personal tasks.

Although Amazon WorkSpaces fully supports the `Action` and `Resource` elements when using the API and command line tools, to use Amazon WorkSpaces from the AWS Management Console, an IAM user must have permissions for the following actions and resources:
+ Actions: `"ds:*"`
+ Resources: `"Resource": "*"`

The following example policy shows how to allow an IAM user to use Amazon WorkSpaces from the AWS Management Console. 

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "workspaces:*",
        "ds:*",
        "iam:GetRole",
        "iam:CreateRole",
        "iam:PutRolePolicy",
        "iam:CreatePolicy",
        "iam:AttachRolePolicy",
        "iam:ListRoles",
        "kms:ListAliases",
        "kms:ListKeys",
        "ec2:CreateVpc",
        "ec2:CreateSubnet",
        "ec2:CreateNetworkInterface",
        "ec2:CreateInternetGateway",
        "ec2:CreateRouteTable",
        "ec2:CreateRoute",
        "ec2:CreateTags",
        "ec2:CreateSecurityGroup",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeRouteTables",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeAvailabilityZones",
        "ec2:AttachInternetGateway",
        "ec2:AssociateRouteTable",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:DeleteSecurityGroup",
        "ec2:DeleteNetworkInterface",
        "ec2:RevokeSecurityGroupEgress",
        "ec2:RevokeSecurityGroupIngress",
        "secretsmanager:ListSecrets",
        "sso-directory:SearchUsers",
        "sso:CreateApplication",
        "sso:DeleteApplication",
        "sso:DescribeApplication",
        "sso:DescribeInstance",
        "sso:GetApplicationGrant",
        "sso:ListInstances",
        
        "sso:PutApplicationAssignmentConfiguration",
        "sso:PutApplicationAuthenticationMethod",
        "sso:PutApplicationGrant"
      ],
      "Resource": "*"
    },
    {
      "Sid": "iamPassRole",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "workspaces.amazonaws.com"
        }
      }
    }
  ]
}
```

------

### Example 3: Grant access to perform WorkSpaces Pools tasks
<a name="perform-workspaces-pools-tasks"></a>

The following policy statement grants an IAM user permission to perform all WorkSpaces Pools tasks.

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "workspaces:*",
                "application-autoscaling:DeleteScalingPolicy",
                "application-autoscaling:DeleteScheduledAction",
                "application-autoscaling:DeregisterScalableTarget",
                "application-autoscaling:DescribeScalableTargets",
                "application-autoscaling:DescribeScalingActivities",
                "application-autoscaling:DescribeScalingPolicies",
                "application-autoscaling:DescribeScheduledActions",
                "application-autoscaling:PutScalingPolicy",
                "application-autoscaling:PutScheduledAction",
                "application-autoscaling:RegisterScalableTarget",
                "cloudwatch:DeleteAlarms",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:PutMetricAlarm",
                "ec2:CreateSecurityGroup",
                "ec2:CreateTags",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "iam:AttachRolePolicy",
                "iam:CreatePolicy",
                "iam:CreateRole",
                "iam:GetRole",
                "iam:ListRoles",
                "iam:PutRolePolicy",
                "secretsmanager:ListSecrets",
                "tag:GetResources"
            ],
            "Resource": "*"
        },
        {
            "Sid": "iamPassRole",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "workspaces.amazonaws.com"
                }
            }
        },
        {
            "Action": "iam:CreateServiceLinkedRole",
            "Effect": "Allow",
            "Resource": "arn:aws:iam::*:role/aws-service-role/workspaces.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_WorkSpacesPool",
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "workspaces.application-autoscaling.amazonaws.com"
                }
            }
        }
    ]
}
```

------

### Example 4: Perform all WorkSpaces tasks for BYOL WorkSpaces
<a name="perform-byol-workspaces-tasks"></a>

The following policy statement grants an IAM user permission to perform all WorkSpaces tasks, including those Amazon EC2 tasks necessary for creating Bring Your Own License (BYOL) WorkSpaces.

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:*",
                "workspaces:*",
                "ec2:AssociateRouteTable",
                "ec2:AttachInternetGateway",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:CreateInternetGateway",
                "ec2:CreateNetworkInterface",
                "ec2:CreateRoute",
                "ec2:CreateRouteTable",
                "ec2:CreateSecurityGroup",
                "ec2:CreateSubnet",
                "ec2:CreateTags",
                "ec2:CreateVpc",
                "ec2:DeleteNetworkInterface",
                "ec2:DeleteSecurityGroup",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeImages",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "ec2:ModifyImageAttribute",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:RevokeSecurityGroupIngress",
                "iam:CreateRole",
                "iam:GetRole",
                "iam:PutRolePolicy",
                "kms:ListAliases",
                "kms:ListKeys"
            ],
            "Resource": "*"
        },
        {
            "Sid": "iamPassRole",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "workspaces.amazonaws.com"
                }
            }
        }
    ]
}
```

------

## Specify WorkSpaces resources in an IAM policy
<a name="wsp_iam_resource"></a>

To specify an WorkSpaces resource in the `Resource` element of the policy statement, use the Amazon Resource Name (ARN) of the resource. You control access to your WorkSpaces resources by either allowing or denying permissions to use the API actions that are specified in the `Action` element of your IAM policy statement. WorkSpaces defines ARNs for WorkSpaces, bundles, IP groups, and directories.

### WorkSpace ARN
<a name="wsp_arn_syntax"></a>

A WorkSpace ARN has the syntax shown in the following example.

```
arn:aws:workspaces:region:account_id:workspace/workspace_identifier
```

*region*  
The Region that the WorkSpace is in (for example, `us-east-1`).

*account\$1id*  
The ID of the AWS account, with no hyphens (for example, `123456789012`).

*workspace\$1identifier*  
The ID of the WorkSpace (for example, `ws-a1bcd2efg`).

The following is the format of the `Resource` element of a policy statement that identifies a specific WorkSpace.

```
"Resource": "arn:aws:workspaces:region:account_id:workspace/workspace_identifier"
```

You can use the `*` wildcard to specify all WorkSpaces that belong to a specific account in a specific Region.

### WorkSpace pool ARN
<a name="wsp_pools_arn_syntax"></a>

A WorkSpace pool ARN has the syntax shown in the following example.

```
arn:aws:workspaces:region:account_id:workspacespool/workspacespool_identifier
```

*region*  
The Region that the WorkSpace is in (for example, `us-east-1`).

*account\$1id*  
The ID of the AWS account, with no hyphens (for example, `123456789012`).

*workspacespool\$1identifier*  
The ID of the WorkSpace pool (for example, `ws-a1bcd2efg`).

The following is the format of the `Resource` element of a policy statement that identifies a specific WorkSpace.

```
"Resource": "arn:aws:workspaces:region:account_id:workspacespool/workspacespool_identifier"
```

You can use the `*` wildcard to specify all WorkSpaces that belong to a specific account in a specific Region.

### Certificate ARN
<a name="wsp_cert_arn_syntax"></a>

A WorkSpace certificate ARN has the syntax shown in the following example.

```
arn:aws:workspaces:region:account_id:workspacecertificate/workspacecertificateidentifier
```

*region*  
The Region that the WorkSpace is in (for example, `us-east-1`).

*account\$1id*  
The ID of the AWS account, with no hyphens (for example, `123456789012`).

*workspacecertificate\$1identifier*  
The ID of the WorkSpace certificate (for example, `ws-a1bcd2efg`).

The following is the format of the `Resource` element of a policy statement that identifies a specific WorkSpace certificate.

```
"Resource": "arn:aws:workspaces:region:account_id:workspacecertificate/workspacecertificate_identifier"
```

You can use the `*` wildcard to specify all WorkSpaces that belong to a specific account in a specific Region.

### Image ARN
<a name="image_arn_syntax"></a>

A WorkSpace image ARN has the syntax shown in the following example.

```
arn:aws:workspaces:region:account_id:workspaceimage/image_identifier
```

*region*  
The Region that the WorkSpace image is in (for example, `us-east-1`).

*account\$1id*  
The ID of the AWS account, with no hyphens (for example, `123456789012`).

*bundle\$1identifier*  
The ID of the WorkSpace image (for example, `wsi-a1bcd2efg`).

The following is the format of the `Resource` element of a policy statement that identifies a specific image.

```
"Resource": "arn:aws:workspaces:region:account_id:workspaceimage/image_identifier"
```

You can use the `*` wildcard to specify all images that belong to a specific account in a specific Region.

### Bundle ARN
<a name="bundle_arn_syntax"></a>

A bundle ARN has the syntax shown in the following example.

```
arn:aws:workspaces:region:account_id:workspacebundle/bundle_identifier
```

*region*  
The Region that the WorkSpace is in (for example, `us-east-1`).

*account\$1id*  
The ID of the AWS account, with no hyphens (for example, `123456789012`).

*bundle\$1identifier*  
The ID of the WorkSpace bundle (for example, `wsb-a1bcd2efg`).

The following is the format of the `Resource` element of a policy statement that identifies a specific bundle.

```
"Resource": "arn:aws:workspaces:region:account_id:workspacebundle/bundle_identifier"
```

You can use the `*` wildcard to specify all bundles that belong to a specific account in a specific Region.

### IP Group ARN
<a name="ipgroup_arn_syntax"></a>

An IP group ARN has the syntax shown in the following example.

```
arn:aws:workspaces:region:account_id:workspaceipgroup/ipgroup_identifier
```

*region*  
The Region that the WorkSpace is in (for example, `us-east-1`).

*account\$1id*  
The ID of the AWS account, with no hyphens (for example, `123456789012`).

*ipgroup\$1identifier*  
The ID of the IP group (for example, `wsipg-a1bcd2efg`).

The following is the format of the `Resource` element of a policy statement that identifies a specific IP group.

```
"Resource": "arn:aws:workspaces:region:account_id:workspaceipgroup/ipgroup_identifier"
```

You can use the `*` wildcard to specify all IP groups that belong to a specific account in a specific Region.

### Directory ARN
<a name="directory_arn_syntax"></a>

A directory ARN has the syntax shown in the following example.

```
arn:aws:workspaces:region:account_id:directory/directory_identifier
```

*region*  
The Region that the WorkSpace is in (for example, `us-east-1`).

*account\$1id*  
The ID of the AWS account, with no hyphens (for example, `123456789012`).

*directory\$1identifier*  
The ID of the directory (for example, `d-12345a67b8`).

The following is the format of the `Resource` element of a policy statement that identifies a specific directory.

```
"Resource": "arn:aws:workspaces:region:account_id:directory/directory_identifier"
```

You can use the `*` wildcard to specify all directories that belong to a specific account in a specific Region.

### Connection alias ARN
<a name="connection_alias_arn_syntax"></a>

A connection alias ARN has the syntax shown in the following example.

```
arn:aws:workspaces:region:account_id:connectionalias/connectionalias_identifier
```

*region*  
The Region that the connection alias is in (for example, `us-east-1`).

*account\$1id*  
The ID of the AWS account, with no hyphens (for example, `123456789012`).

*connectionalias\$1identifier*  
The ID of the connection alias (for example, `wsca-12345a67b8`).

The following is the format of the `Resource` element of a policy statement that identifies a specific connection alias.

```
"Resource": "arn:aws:workspaces:region:account_id:connectionalias/connectionalias_identifier"
```

You can use the `*` wildcard to specify all connection aliases that belong to a specific account in a specific Region.

### API actions with no support for resource-level permissions
<a name="no-resource-level-permissions"></a>

You can't specify a resource ARN with the following API actions:
+ `AssociateIpGroups`
+ `CreateIpGroup`
+ `CreateTags`
+ `DeleteTags`
+ `DeleteWorkspaceImage`
+ `DescribeAccount`
+ `DescribeAccountModifications`
+ `DescribeIpGroups`
+ `DescribeTags`
+ `DescribeWorkspaceDirectories`
+ `DescribeWorkspaceImages`
+ `DescribeWorkspaces`
+ `DescribeWorkspacesConnectionStatus`
+ `DisassociateIpGroups`
+ `ImportWorkspaceImage`
+ `ListAvailableManagementCidrRanges`
+ `ModifyAccount`

For API actions that don't support resource-level permissions, you must specify the resource statement shown in the following example.

```
"Resource": "*"
```

### API actions that don't support account-level restrictions on shared resources
<a name="shared-resource-permissions"></a>

For the following API actions, you can't specify an account ID in the resource ARN when the resource isn't owned by the account:
+ `AssociateConnectionAlias`
+ `CopyWorkspaceImage`
+ `DisassociateConnectionAlias`

For these API actions, you can specify an account ID in the resource ARN only when that account owns the resources to be acted upon. When the account doesn't own the resources, you must specify `*` for the account ID, as shown in the following example.

```
"arn:aws:workspaces:region:*:resource_type/resource_identifier"
```

## Create the workspaces\$1DefaultRole Role
<a name="create-default-role"></a>

Before you can register a directory using the API, you must verify that a role named `workspaces_DefaultRole` exists. This role is created by the Quick Setup or if you launch a WorkSpace using the AWS Management Console, and it grants Amazon WorkSpaces permission to access specific AWS resources on your behalf. If this role does not exist, you can create it using the following procedure.

**To create the workspaces\$1DefaultRole role**

1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).

1. In the navigation pane on the left, choose **Roles**.

1. Choose **Create role**.

1. Under **Select type of trusted entity**, choose **Another AWS account**.

1. For **Account ID**, enter your account ID with no hyphens or spaces.

1. For **Options**, do not specify multi-factor authentication (MFA).

1. Choose **Next: Permissions**.

1. On the **Attach permissions policies** page, select the AWS managed policies **AmazonWorkSpacesServiceAccess**, **AmazonWorkSpacesSelfServiceAccess**, and **AmazonWorkSpacesPoolServiceAccess**. For more information about these managed policies, see [AWS managed policies for WorkSpaces](managed-policies.md).

1. Under **Set permissions boundary**, we recommend that you not use a permissions boundary because of the potential for conflicts with the policies that are attached to this role. Such conflicts could block certain necessary permissions for the role.

1. Choose **Next: Tags**.

1. On the **Add tags (optional)** page, add tags if needed.

1. Choose **Next: Review**.

1. On the **Review** page, for **Role name**, enter **workspaces\$1DefaultRole**.

1. (Optional) For **Role description**, enter a description.

1. Choose **Create Role**.

1. On the **Summary** page for the workspaces\$1DefaultRole role, choose the **Trust relationships** tab.

1. On the **Trust relationships** tab, choose **Edit trust relationship**.

1. On the **Edit Trust Relationship** page, replace the existing policy statement with the following statement.

   ```
   {
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Service": "workspaces.amazonaws.com"
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }
   ```

1. Choose **Update Trust Policy**.

## Create the AmazonWorkSpacesPCAAccess service role
<a name="create-pca-access-role"></a>

Before users can login using certificate-based authentication, you must verify that a role named `AmazonWorkSpacesPCAAccess` exists. This role is created when you enable certificate-based authentication on a Directory using the AWS Management Console, and it grants Amazon WorkSpaces permission to access AWS Private CA resources on your behalf. If this role does not exist because you are not using the console to manage certificate-based authentication, you can create it using the following procedure.

**To create the AmazonWorkSpacesPCAAccess service role using the AWS CLI**

1. Create a JSON file named `AmazonWorkSpacesPCAAccess.json` with the following text.

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Service": "prod.euc.ecm.amazonaws.com"
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }
   ```

------

1. Adjust the `AmazonWorkSpacesPCAAccess.json` path as needed and run the following AWS CLI commands to create the service role and attach the [AmazonWorkspacesPCAAccess](managed-policies.md#workspaces-pca-access) managed policy.

   ```
   aws iam create-role --path /service-role/ --role-name AmazonWorkSpacesPCAAccess --assume-role-policy-document file://AmazonWorkSpacesPCAAccess.json
   ```

   ```
   aws iam attach-role-policy —role-name AmazonWorkSpacesPCAAccess —policy-arn arn:aws:iam::aws:policy/AmazonWorkspacesPCAAccess
   ```

# AWS managed policies for WorkSpaces
<a name="managed-policies"></a>

Using AWS managed policies makes adding permissions to users, groups, and roles easier than writing policies yourself. It takes time and expertise to create [ IAM customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) that provide your team with only the permissions they need. Use AWS managed policies to get started quickly. These policies cover common use cases and are available in your AWS account. For more information about AWS managed policies, see [AWS managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) in the *IAM User Guide*.

AWS services maintain and update AWS managed policies. You can't change the permissions in AWS managed policies. Services may occasionally add additional permissions to an AWS managed policy to support new features. This type of update affects all identities (users, groups, and roles) where the policy is attached. Services are most likely to update an AWS managed policy when a new feature is launched or when new operations become available. Services don't remove permissions from an AWS managed policy, so policy updates won't break your existing permissions.

Additionally, AWS supports managed policies for job functions that span multiple services. For example, the `ReadOnlyAccess` AWS managed policy provides read-only access to all AWS services and resources. When a service launches a new feature, AWS adds read-only permissions for new operations and resources. For a list and descriptions of job function policies, see [AWS managed policies for job functions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html) in the *IAM User Guide*.

## AWS managed policy: AmazonWorkSpacesAdmin
<a name="workspaces-admin"></a>

**Note**  
Permissions listed are for SDK only and will not work for the Console. Console requires additional permissions listed in [Amazon WorkSpaces Console operations permissions reference](wsp-console-permissions-ref.md).

This policy provides access to Amazon WorkSpaces administrative actions. It provides the following permissions:
+ `workspaces` - Allows access to perform administrative actions on WorkSpaces Personal and WorkSpaces Pools resources.
+ `kms` - Allows access to list and describe KMS keys, as well as list aliases.

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "AmazonWorkSpacesAdmin",
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey",
                "kms:ListAliases",
                "kms:ListKeys",
                "workspaces:CreateTags",
                "workspaces:CreateWorkspaceImage",
                "workspaces:CreateWorkspaces",
                "workspaces:CreateWorkspacesPool",
                "workspaces:CreateStandbyWorkspaces",
                "workspaces:DeleteTags",
                "workspaces:DeregisterWorkspaceDirectory",
                "workspaces:DescribeTags",
                "workspaces:DescribeWorkspaceBundles",
                "workspaces:DescribeWorkspaceDirectories",
                "workspaces:DescribeWorkspaces",
                "workspaces:DescribeWorkspacesPools",
                "workspaces:DescribeWorkspacesPoolSessions",
                "workspaces:DescribeWorkspacesConnectionStatus",
                "workspaces:ModifyCertificateBasedAuthProperties",
                "workspaces:ModifySamlProperties",
                "workspaces:ModifyStreamingProperties",
                "workspaces:ModifyWorkspaceCreationProperties",
                "workspaces:ModifyWorkspaceProperties",
                "workspaces:RebootWorkspaces",
                "workspaces:RebuildWorkspaces",
                "workspaces:RegisterWorkspaceDirectory",
                "workspaces:RestoreWorkspace",
                "workspaces:StartWorkspaces",
                "workspaces:StartWorkspacesPool",
                "workspaces:StopWorkspaces",
                "workspaces:StopWorkspacesPool",
                "workspaces:TerminateWorkspaces",
                "workspaces:TerminateWorkspacesPool",
                "workspaces:TerminateWorkspacesPoolSession",
                "workspaces:UpdateWorkspacesPool"
            ],
            "Resource": "*"
        }
    ]
}
```

------

## AWS managed policy: AmazonWorkspacesPCAAccess
<a name="workspaces-pca-access"></a>

This managed policy provides access to AWS Certificate Manager Private Certificate Authority (Private CA) resources in your AWS account for certificate-based authentication. It is included in the AmazonWorkSpacesPCAAccess role, and it provides the following permissions:
+ `acm-pca` - Allows access to AWS Private CA to manage certificate-based authentication.

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "acm-pca:IssueCertificate",
                "acm-pca:GetCertificate",
                "acm-pca:DescribeCertificateAuthority"
            ],
            "Resource": "arn:*:acm-pca:*:*:*",
            "Condition": {
                "StringLike": {
                    "aws:ResourceTag/euc-private-ca": "*"
                }
            }
        }
    ]
}
```

------

## AWS managed policy: AmazonWorkSpacesSelfServiceAccess
<a name="workspaces-self-service-access"></a>

This policy provides access to the Amazon WorkSpaces service to perform WorkSpaces self-service actions initiated by a user. It is included in the `workspaces_DefaultRole` role, and it provides the following permissions:
+ `workspaces` - Allows access to self-service WorkSpaces management capabilities for users.

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Action": [
                "workspaces:RebootWorkspaces",
                "workspaces:RebuildWorkspaces",
                "workspaces:ModifyWorkspaceProperties"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}
```

------

## AWS managed policy: AmazonWorkSpacesServiceAccess
<a name="workspaces-service-access"></a>

This policy provides customer account access to the Amazon WorkSpaces service for launching a WorkSpace. It is included in the `workspaces_DefaultRole` role, and it provides the following permissions:
+ `ec2` - Allows access to manage Amazon EC2 resources associated with a WorkSpace, such as network interfaces.

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Action": [
                "ec2:CreateNetworkInterface",
                "ec2:DeleteNetworkInterface",
                "ec2:DescribeNetworkInterfaces"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}
```

------

## AWS managed policy: AmazonWorkSpacesPoolServiceAccess
<a name="workspaces-pools-service-access"></a>

This policy is used in the workspaces\$1DefaultRole, which WorkSpaces uses to access required resources in the customer AWS account for WorkSpaces Pools. For more information see [Create the workspaces\$1DefaultRole Role](workspaces-access-control.md#create-default-role). It provides the following permissions:
+ `ec2` - Allows access to manage Amazon EC2 resources associated with a WorkSpaces Pool, such as VPCs, subnets, availability zones, security groups, and route tables.
+ `s3` - Allows access to perform actions on Amazon S3 buckets required for logs, application settings, and the Home Folder feature.

------
#### [ Commercial AWS Regions ]

The following policy JSON applies to the commercial AWS Regions.

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "ProvisioningWorkSpacesPoolPermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeRouteTables",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "WorkSpacesPoolS3Permissions",
            "Effect": "Allow",
            "Action": [
                "s3:CreateBucket",
                "s3:ListBucket",
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:GetObjectVersion",
                "s3:DeleteObjectVersion",
                "s3:GetBucketPolicy",
                "s3:PutBucketPolicy",
                "s3:PutEncryptionConfiguration"
            ],
            "Resource": [
                "arn:aws:s3:::wspool-logs-*",
                "arn:aws:s3:::wspool-app-settings-*",
                "arn:aws:s3:::wspool-home-folder-*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        }
    ]
}
```

------

------
#### [ AWS GovCloud (US) Regions ]

The following policy JSON applies to the commercial AWS GovCloud (US) Regions.

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "ProvisioningWorkSpacesPoolPermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeRouteTables",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "WorkSpacesPoolS3Permissions",
            "Effect": "Allow",
            "Action": [
                "s3:CreateBucket",
                "s3:ListBucket",
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:GetObjectVersion",
                "s3:DeleteObjectVersion",
                "s3:GetBucketPolicy",
                "s3:PutBucketPolicy",
                "s3:PutEncryptionConfiguration"
            ],
            "Resource": [
                "arn:aws-us-gov:s3:::wspool-logs-*",
                "arn:aws-us-gov:s3:::wspool-app-settings-*",
                "arn:aws-us-gov:s3:::wspool-home-folder-*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        }
    ]
}
```

------

------

## WorkSpaces updates to AWS managed policies
<a name="updates-managed-policies"></a>

View details about updates to AWS managed policies for WorkSpaces since this service began tracking these changes.


| Change | Description | Date | 
| --- | --- | --- | 
| [AWS managed policy: AmazonWorkSpacesPoolServiceAccess](#workspaces-pools-service-access) - Added new policy | WorkSpaces added a new managed policy to grant permission to view Amazon EC2 VPCs and related resources, and to view and manage Amazon S3 buckets for WorkSpaces Pools. | June 24, 2024 | 
| [AWS managed policy: AmazonWorkSpacesAdmin](#workspaces-admin) - Updated policy | WorkSpaces added several actions for WorkSpaces Pools to the Amazon WorkSpacesAdmin managed policy, granting admins access to manage WorkSpace Pool resources. | June 24, 2024 | 
| [AWS managed policy: AmazonWorkSpacesAdmin](#workspaces-admin) - Updated policy | WorkSpaces added the workspaces:RestoreWorkspace action to the Amazon WorkSpacesAdmin managed policy, granting admins access to restore WorkSpaces.  | June 25, 2023 | 
| [AWS managed policy: AmazonWorkspacesPCAAccess](#workspaces-pca-access) - Added new policy | WorkSpaces added a new managed policy to grant acm-pca permission to manage AWS Private CA to manage certificate-based authentication. | November 18, 2022 | 
| WorkSpaces started tracking changes | WorkSpaces started tracking changes for its WorkSpaces managed policies. | March 1, 2021 | 

# Access to WorkSpaces and scripts on streaming instances
<a name="using-iam-roles-to-grant-permissions-to-applications-scripts-streaming-instances"></a>

Applications and scripts that run on WorkSpaces streaming instances must include AWS credentials in their AWS API requests. You can create an IAM role to manage these credentials. An IAM role specifies a set of permissions that you can use to access AWS resources. This role is not uniquely associated with one person, however. Instead, it can be assumed by anyone that needs it.

You can apply an IAM role to a WorkSpaces streaming instance. When the streaming instance switches to (assumes) the role, the role provides temporary security credentials. Your application or scripts use these credentials to perform API actions and management tasks on the streaming instance. WorkSpaces manages the temporary credential switch for you.

**Topics**
+ [

## Best Practices for Using IAM Roles With WorkSpaces Streaming Instances
](#best-practices-for-using-iam-role-with-streaming-instances)
+ [

## Configuring an Existing IAM Role to Use With WorkSpaces Streaming Instances
](#configuring-existing-iam-role-to-use-with-streaming-instances)
+ [

## How to Create an IAM Role to Use With WorkSpaces Streaming Instances
](#how-to-create-iam-role-to-use-with-streaming-instances)
+ [

## How to Use the IAM Role With WorkSpaces Streaming Instances
](#how-to-use-iam-role-with-streaming-instances)

## Best Practices for Using IAM Roles With WorkSpaces Streaming Instances
<a name="best-practices-for-using-iam-role-with-streaming-instances"></a>

When you use IAM roles with WorkSpaces streaming instances, we recommend that you follow these practices:
+ Limit the permissions that you grant to AWS API actions and resources.

  Follow least privilege principles when you create and attach IAM policies to the IAM roles associated with WorkSpaces streaming instances. When you use an application or script that requires access to AWS API actions or resources, determine the specific actions and resources that are required. Then, create policies that allow the application or script to perform only those actions. For more information, see [Grant Least Privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege) in the *IAM User Guide*.
+ Create an IAM role for each WorkSpaces resource.

  Creating a unique IAM role for each WorkSpaces resource is a practice that follows least privilege principles. Doing so also lets you modify permissions for a resource without affecting other resources.
+ Limit where the credentials can be used.

  IAM policies let you define the conditions under which your IAM role can be used to access a resource. For example, you can include conditions to specify a range of IP addresses that requests can come from. Doing so prevents the credentials from being used outside of your environment. For more information, see [Use Policy Conditions for Extra Security](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#use-policy-conditions) in the *IAM User Guide*.

## Configuring an Existing IAM Role to Use With WorkSpaces Streaming Instances
<a name="configuring-existing-iam-role-to-use-with-streaming-instances"></a>

This topic describes how to configure an existing IAM role so that you can use it with WorkSpaces .

**Prerequisites**

The IAM role that you want to use with WorkSpaces must meet the following prerequisites:
+ The IAM role must be in the same Amazon Web Services account as the WorkSpaces streaming instance.
+ The IAM role cannot be a service role.
+ The trust relationship policy that is attached to the IAM role must include the WorkSpaces service as the principal. A *principal* is an entity in AWS that can perform actions and access resources. The policy must also include the `sts:AssumeRole` action. This policy configuration defines WorkSpaces as a trusted entity.

  
+ If you are applying the IAM role to WorkSpaces, the WorkSpaces must run a version of the WorkSpaces agent released on or after September 3, 2019. If you are applying the IAM role to WorkSpaces, the WorkSpaces must use an image that uses a version of the agent released on or after the same date. 

**To enable the WorkSpaces service principal to assume an existing IAM role**

To perform the following steps, you must sign into the account as an IAM user who has the permissions required to list and update IAM roles. If you don't have the required permissions, ask your Amazon Web Services account administrator either to perform these steps in your account or to grant you the required permissions.

1. Open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).

1. In the navigation pane, choose **Roles**. 

1. In the list of roles in your account, choose the name of the role that you want to modify.

1. Choose the **Trust relationships** tab, and then choose **Edit trust relationship**.

1. Under **Policy Document**, verify that the trust relationship policy includes the `sts:AssumeRole` action for the `workspaces.amazonaws.com` service principal:

------
#### [ JSON ]

****  

   ```
   {
     "Version":"2012-10-17",		 	 	 
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Service": [
             "workspaces.amazonaws.com"
           ]
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }
   ```

------

1. When you are finished editing your trust policy, choose **Update Trust Policy** to save your changes. 

1. The IAM role that you selected will display in the WorkSpaces console. This role grants permissions to applications and scripts to perform API actions and management tasks on streaming instances.

## How to Create an IAM Role to Use With WorkSpaces Streaming Instances
<a name="how-to-create-iam-role-to-use-with-streaming-instances"></a>

This topic describes how to create a new IAM role so that you can use it with WorkSpaces

1. Open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).

1. In the navigation pane, choose **Roles**, and then choose **Create role**.

1. For **Select type of trusted entity**, choose **AWS service**.

1. From the list of AWS services, choose **WorkSpaces**.

1. Under **Select your use case**, **WorkSpaces — Allows WorkSpaces instances to call AWS services on your behalf** is already selected. Choose **Next: Permissions**.

1. If possible, select the policy to use for the permissions policy or choose **Create policy** to open a new browser tab and create a new policy from scratch. For more information, see step 4 in the procedure [Creating IAM Policies (Console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html#access_policies_create-start) in the *IAM User Guide*.

   After you create the policy, close that tab and return to your original tab. Select the check box next to the permissions policies that you want WorkSpaces to have.

1. (Optional) Set a permissions boundary. This is an advanced feature that is available for service roles, but not service-linked roles. For more information, see [Permissions Boundaries for IAM Entities ](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) in the *IAM User Guide*.

1. Choose **Next: Tags**. You can optionally attach tags as key-value pairs. For more information, see [Tagging IAM Users and Roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *IAM User Guide*.

1. Choose **Next: Review**.

1. For **Role name**, type a role name that is unique within your Amazon Web Services account. Because other AWS resources might reference the role, you can't edit the name of the role after it has been created.

1. For **Role description**, keep the default role description or type a new one.

1. Review the role, and then choose **Create role**.

## How to Use the IAM Role With WorkSpaces Streaming Instances
<a name="how-to-use-iam-role-with-streaming-instances"></a>

After you create an IAM role, you can apply it to WorkSpaces when you launch WorkSpaces. You can also apply an IAM role to existing WorkSpaces.

When you apply an IAM role to WorkSpaces, WorkSpaces retrieves temporary credentials and creates the **workspaces\$1machine\$1role** credential profile on the instance. The temporary credentials are valid for 1 hour, and new credentials retrieved every hour. The previous credentials do not expire, so you can use them for as long as they are valid. You can use the credential profile to call AWS services programmatically by using the AWS Command Line Interface (AWS CLI), AWS Tools for PowerShell, or the AWS SDK with the language of your choice.

When you make the API calls, specify **workspaces\$1machine\$1role** as the credential profile. Otherwise, the operation fails due to insufficient permissions.

WorkSpaces assumes the specified role while the streaming instance is provisioned. Because WorkSpaces uses the elastic network interface that is attached to your VPC for AWS API calls, your application or script must wait for the elastic network interface to become available before making AWS API calls. If API calls are made before the elastic network interface is available, the calls fail.

The following examples show how you can use the **workspaces\$1machine\$1role** credential profile to describe streaming instances (EC2 instances) and to create the Boto client. Boto is the Amazon Web Services (AWS) SDK for Python. 

**Describe Streaming Instances (EC2 instances) by Using the AWS CLI**

```
aws ec2 describe-instances --region us-east-1 --profile workspaces_machine_role
```

**Describe Streaming Instances (EC2 instances) by Using AWS Tools for PowerShell**

You must use AWS Tools for PowerShell version 3.3.563.1 or later, with the Amazon Web Services SDK for .NET version 3.3.103.22 or later. You can download the AWS Tools for Windows installer, which includes AWS Tools for PowerShell and the Amazon Web Services SDK for .NET, from the [AWS Tools for PowerShell](https://aws.amazon.com/powershell/) website.

```
Get-EC2Instance -Region us-east-1 -ProfileName workspaces_machine_role
```

**Creating the Boto Client by Using the AWS SDK for Python**

```
session = boto3.Session(profile_name=workspaces_machine_role')
```

# Amazon WorkSpaces Console operations permissions reference
<a name="wsp-console-permissions-ref"></a>

Some Amazon WorkSpaces APIs can only be called through the AWS Management Console. They are not public APIs, in the sense they cannot be called programmatically, and they are not provided by any SDK. These API operations include:
+ workspaces:DirectoryAccessManagement
+ workspaces:CreateRootClientCertificate
+ workspaces:UpdateRootClientCertificate
+ workspaces:DeleteRootClientCertificate
+ workspaces:DescribeConsent
+ workspaces:UpdateConsent
+ workspaces:InvokeTroubleshootingInvestigation
+ workspaces:GetTroubleshootingRecommendation
+ workspaces:ListTroubleshootingRecommendations

## WorkSpaces Console operations and required permissions for actions
<a name="wsp-console-operations"></a>

The console uses additional API actions for its features, so the permissions for the WorkSpaces public APIs may not be sufficient. For example, a user that has permissions to use the [CreateWorkspaces](https://docs.aws.amazon.com/workspaces/latest/api/API_CreateWorkspaces.html) API via CLI/SDK may encounter errors when trying to create a WorkSpace on the console, because they are missing certain permissions to select or create Users. This table lists the features that are only available on the WorkSpaces Console and the required additional permissions that enable users to work with these specific parts of the console.

The [Example policies](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-access-control.html#workspaces-example-iam-policies) section provides the list of permissions to perform all WorkSpaces tasks for Personal, Pools and BYOL WorkSpaces. 

Alternatively, you could also use granular permissions to apply least-privilege permissions to perform a task.

This table lists the WorkSpaces Console features that rely on the APIs that are not provided by the SDK and the required permissions that enable users to work with these specific parts of the console. These permissions should be added in addition to other actions required for APIs provided by the SDK. 


| WorkSpaces Console operations | Required permissions | 
| --- | --- | 
|  [WorkSpaces Personal Quick Setup](https://docs.aws.amazon.com/workspaces/latest/adminguide/managing-wsp-personal.html#getting-started)  |  workspaces:DirectoryAccessManagement ds:\$1 ec2:CreateVpc ec2:CreateSubnet ec2:CreateNetworkInterface ec2:CreateInternetGateway ec2:CreateRouteTable ec2:CreateRoute ec2:CreateTags ec2:CreateSecurityGroup ec2:DescribeInternetGateways ec2:DescribeSecurityGroups ec2:DescribeRouteTables ec2:DescribeVpcs ec2:DescribeSubnets ec2:DescribeNetworkInterfaces ec2:DescribeAvailabilityZones ec2:AttachInternetGateway ec2:AssociateRouteTable ec2:AuthorizeSecurityGroupIngress ec2:AuthorizeSecurityGroupEgress iam:CreateRole iam:GetRole iam:PutRolePolicy workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:CreateWorkspaces workspaces:DescribeWorkspaces workspaces:RegisterWorkspaceDirectory workspaces:DescribeWorkspaceBundles workspaces:DescribeWorkspaces  | 
|  [Restrict access to Trusted Devices for WorkSpaces Personal](https://docs.aws.amazon.com/workspaces/latest/adminguide/trusted-devices.html#configure-restriction)  |  workspaces:CreateRootClientCertificate workspaces:UpdateRootClientCertificate workspaces:DeleteRootClientCertificate ds:DescribeDirectories ec2:DescribeSubnets ec2:DescribeSecurityGroups workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DescribeTags workspaces:DescribeClientProperties workspaces:DescribeConnectClientAddins workspaces:DirectoryAccessManagement  | 
|  [Creating a WorkSpace in WorkSpaces Personal on the Console](https://docs.aws.amazon.com/workspaces/latest/adminguide/create-workspaces-personal.html) – To create/search/describe Directory Service directory users  |  workspaces:DirectoryAccessManagement workspaces:DescribeAccount workspaces:CreateWorkspaces workspaces:DescribeWorkspaces workspaces:DescribeWorkspaceDirectories workspaces:DescribeWorkspaceBundles workspaces:DescribeTags workspaces:CreateTags workspaces:DescribeClientProperties kms:ListKeys kms:ListAliases kms:DescribeKey ds:DescribeTrusts ds:DescribeDirectories ec2:DescribeSubnets ec2:DescribeSecurityGroups  | 
|  [Manage users in WorkSpaces Personal](https://docs.aws.amazon.com/workspaces/latest/adminguide/manage-workspaces-users.html) – To edit users and send user invitation email  |  workspaces:DirectoryAccessManagement workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DescribeWorkspaces workspaces:DescribeTags workspaces:DescribeWorkspaceBundles workspaces:DescribeWorkspacesConnectionStatus workspaces:DescribeWorkspaceAssociations workspaces:DescribeWorkspaceSnapshots workspaces:DescribeWorkspaceImages workspaces:DescribeConnectionAliases  | 
|  [Update the AD Connector account (AD Connector) for WorkSpaces Personal](https://docs.aws.amazon.com/workspaces/latest/adminguide/connect-account.html)  |  workspaces:DirectoryAccessManagement ds:DescribeDirectories ds:UpdateDirectory ec2:DescribeSubnets ec2:DescribeSecurityGroups workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DescribeTags workspaces:DescribeClientProperties workspaces:DescribeConnectClientAddins  | 
|  [Select an organizational unit for WorkSpaces Personal](https://docs.aws.amazon.com/workspaces/latest/adminguide/select-ou.html)  |  workspaces:DirectoryAccessManagement ds:DescribeDirectories ec2:DescribeSubnets ec2:DescribeSecurityGroups workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DescribeTags workspaces:DescribeClientProperties workspaces:DescribeConnectClientAddins workspaces:ModifyWorkspaceCreationProperties  | 
|  [Enable your account for BYOL](https://docs.aws.amazon.com/workspaces/latest/adminguide/byol-windows-images.html) – To confirm understanding of the requirements to use BYOL WorkSpaces  |  workspaces:DescribeConsent workspaces:UpdateConsent workspaces:DescribeAccount workspaces:ListAccountLinks workspaces:DescribeWorkspaceBundles workspaces:DescribeWorkspaceImages workspaces:DescribeWorkspaceDirectories  | 
|  [Amazon WorkSpaces Advisor](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-advisor.html)  |  workspaces:InvokeTroubleshootingInvestigation workspaces:GetTroubleshootingRecommendation workspaces:ListTroubleshootingRecommendations  |