VPC endpoints
Amazon S3 VPC endpoint
Many Amazon WorkSpaces Applications deployments require user state
persistence through home folders and application settings.
Enable private communication to these
Amazon Simple
Storage Service
-
It is cost optimized for WorkSpaces Applications network access requirements
-
Amazon S3 bucket access is not required from on-premises resources
-
A custom policy document can be used to restrict access only from the WorkSpaces Applications instances
Once you create the VPC endpoint gateway, it is a best practice to secure the privatized connection by creating a custom policy. Custom policy starts with the Amazon Resource Name (ARN) of the WorkSpaces Applications service Identity and Access Management role. Explicitly specify the S3 actions required for user state persistence.
Note
The following example in the Resources
section specifies the state home folder path first and the
applications settings path second.
Example
Amazon WorkSpaces Applications API interface VPC endpoint
In design scenarios where API and CLI commands to Amazon WorkSpaces Applications originate in your VPC, privatize these programmatic calls through an interface VPC endpoint.
Amazon WorkSpaces Applications streaming interface VPC endpoint
While it is possible to route Amazon WorkSpaces Applications streaming traffic through an interface VPC endpoint, use this configuration with caution. The default streaming behavior through the public internet is the most efficient and performant delivery method for Amazon WorkSpaces Applications streaming traffic.
Amazon WorkSpaces Applications streaming interface VPC endpoint
As shown in the previous figure, the public internet is the most efficient path to Amazon WorkSpaces Applications Streaming Gateways. Routing through the customer-managed VPC and networking adds complexity and latency. It also adds data transfer fees over Direct Connect.
Note
Only streaming is supported by the VPC endpoint, and authentication must still take place over the public internet. Prerequisite access such as SAML Single Sign-On (SSO) Identity Provider (IdP) remain a requirement that are accessible only through the public internet.
