Amazon WorkSpaces Architecture: End-to-End Enterprise Deployment & Reference Blueprint

By /

Amazon WorkSpaces is a fully managed, secure Virtual Desktop Infrastructure (VDI) solution running on AWS. It provides end users with virtualized Windows or Linux desktop environments accessible from any supported client application or web browser.

This guide covers the entire lifecycle of an Amazon WorkSpaces deployment—from foundational architectural prerequisites and network design to directory integration, image creation, user provisioning, and enterprise best practices.

🏛️ 1. High-Level Architectural Overview

Amazon WorkSpaces decouples the compute and desktop environment into two managed zones:

  1. AWS Managed Control Plane (Management VPC): AWS handles connection brokering, authentication gateways, pixel streaming endpoints, and infrastructure management.
  2. Customer Managed Data Plane (Customer VPC): Contains the Virtual Network Interfaces (ENIs) connected to your private subnets. This allows WorkSpaces to securely access internal resources (file shares, databases, intranet apps) through standard routing, security groups, and transit gateways.
                     ┌───────────────────────────────────────────────────┐
                     │                 User Device                       │
                     │  (WorkSpaces Client App / Zero Client / Web)      │
                     └─────────────────────────┬─────────────────────────┘
                                               │ Encrypted Pixel Stream
                                               │ (WSP / PCoIP: Port 4172 / 443)
                                               ▼
  ┌────────────────────────────────────────────────────────────────────────────────────────┐
  │  AWS MANAGED CONTROL PLANE                                                             │
  │  ┌─────────────────────────────────┐        ┌──────────────────────────────────────┐  │
  │  │   Auth & Brokering Gateway      │        │  Streaming Gateways & Edge Locs      │  │
  │  └────────────────┬────────────────┘        └──────────────────┬───────────────────┘  │
  └───────────────────┼────────────────────────────────────────────┼───────────────────────┘
                      │                                            │
                      │ Directory / Auth                           │ Private ENI Traffic
                      ▼                                            ▼
  ┌────────────────────────────────────────────────────────────────────────────────────────┐
  │  CUSTOMER AWS ACCOUNT (CUSTOMER VPC)                                                   │
  │                                                                                        │
  │   ┌───────────────────────────────┐          ┌─────────────────────────────────────┐   │
  │   │  Private Subnet A (AZ-1)      │          │  Private Subnet B (AZ-2)            │   │
  │   │  ┌─────────────────────────┐  │          │  ┌─────────────────────────┐       │   │
  │   │  │   WorkSpace Instance    │  │          │  │   WorkSpace Instance    │       │   │
  │   │  │   (eth0: Customer ENI)  │  │          │  │   (eth0: Customer ENI)  │       │   │
  │   │  └────────────┬────────────┘  │          │  └────────────┬────────────┘       │   │
  │   └───────────────┼───────────────┘          └───────────────┼────────────────────┘   │
  │                   │                                          │                        │
  │                   └───────────────────┬──────────────────────┘                        │
  │                                       ▼                                               │
  │               ┌───────────────────────────────────────────────┐                       │
  │               │ AWS Directory Service / AD Connector          │                       │
  │               └───────────────────────┬───────────────────────┘                       │
  └───────────────────────────────────────┼───────────────────────────────────────────────┘
                                          ▼
                         ┌─────────────────────────────────┐
                         │  On-Premises Active Directory   │
                         │  (via Direct Connect / IPsec)   │
                         └─────────────────────────────────┘

Core Architecture Components

  • WorkSpaces Streaming Protocol (WSP) & PCoIP: High-performance pixel streaming protocols that encode audio, video, and display streams over encrypted UDP/TCP channels.
  • Directory Services: Manages computer accounts and user authentications (AWS Managed Microsoft AD, AD Connector, or Simple AD).
  • Bundle: A combination of OS, compute (vCPU, RAM), and storage allocations (Root & User volumes).
  • Image: A template containing the OS, software configurations, and patches used to create custom bundles.

📋 2. Prerequisites & Pre-Deployment Checklist

Before deploying Amazon WorkSpaces, ensure your infrastructure meets these fundamental prerequisites:

A. Networking & VPC Design

  • Dual-AZ Subnet Requirement: AWS Directory Service requires at least 2 private subnets across 2 separate Availability Zones (AZs).
  • CIDR Sizing: Each WorkSpace assigns two IP addresses: one ENI in the customer VPC for local network access and one managed ENI for streaming traffic. Allocate subnets with sufficient headroom (e.g., /22 or /21 for large deployments).
  • NAT Gateway / Internet Access: WorkSpaces require outbound internet access for OS updates, anti-virus definition updates, and AWS agent heartbeats (via NAT Gateway or AWS Network Firewall).

B. Directory Service Options

Select the directory model that fits your enterprise identity architecture:

Directory TypeIdeal Use CaseOn-Prem Integration
AD ConnectorExisting On-Premises or EC2-hosted Active Directory. Acts as a proxy—no objects stored in AWS.Direct Connect / IPsec VPN required
AWS Managed Microsoft ADManaged Active Directory running inside AWS. Supports forest trusts to on-prem AD.Optional (via 1-way or 2-way Trust)
Simple ADStandalone Samba 4-powered directory for small environments or testing.Not supported

C. Firewall & Network Ports

Ensure the following ports are allowed in your security groups and corporate network firewalls:

# Inbound / Outbound Ports required for WorkSpaces Client to AWS Endpoints:
TCP 443  (HTTPS)       -> Registration, Authentication, and Web Access
TCP 4172 (PCoIP/WSP)   -> Streaming session control
UDP 4172 (PCoIP/WSP)   -> Streaming pixel data
UDP 4195 (WSP)         -> WSP streaming audio/video optimization

# Customer VPC Internal Traffic (WorkSpace ENI -> Directory / Internal Services):
TCP/UDP 53  (DNS)      -> Directory resolution
TCP/UDP 88  (Kerberos) -> User authentication
TCP/UDP 389 (LDAP)     -> AD queries
TCP 445     (SMB)      -> Group policy & user profile sync

🛠️ 3. Step-by-Step Deployment Guide

Follow this sequential roadmap to deploy a production-grade Amazon WorkSpaces environment.

Step 1: Prepare the Network Infrastructure (VPC & Subnets)

  1. Navigate to the Amazon VPC Console.
  2. Create a VPC with an IPv4 CIDR block (e.g., 10.100.0.0/16).
  3. Create at least two private subnets in different Availability Zones:
    • Private-Subnet-A: 10.100.1.0/24 (AZ 1)
    • Private-Subnet-B: 10.100.2.0/24 (AZ 2)
  4. Attach a Route Table routing 0.0.0.0/0 traffic to a NAT Gateway located in a public subnet.

Step 2: Configure AWS Directory Service

(Example using AD Connector for existing Active Directory)

  1. Navigate to AWS Directory Service > Set up directory.
  2. Select AD Connector > Choose Size (Small or Large based on user count).
  3. Select your VPC and the two private subnets created in Step 1.
  4. Enter your Active Directory parameters:
    • Directory DNS Name: corp.domain.com
    • DNS IP Addresses: IPs of your on-premises domain controllers or DNS resolvers.
    • Service Account Username & Password: An AD account with permissions to join computers to the domain.
  5. Review and complete creation (takes 5–10 minutes).

Step 3: Register Directory with Amazon WorkSpaces

  1. Navigate to the Amazon WorkSpaces Console > Directories.
  2. Select your newly created directory and click Register.
  3. Select your two private subnets.
  4. Configure Directory Details & Access Properties:
    • Enable Self-Service Permissions: Allow/Deny users to change execution mode, rebuild, or resize their WorkSpace.
    • Access Control Options: Restrict access to specific IP ranges or require trusted devices (certificates).
    • Protocol: Select WorkSpaces Streaming Protocol (WSP) for enhanced performance and smart-card support.

Step 4: Create Custom WorkSpaces Image & Bundle

To ensure compliance and standardization across your enterprise, build a master custom image:

  1. Launch a Base WorkSpace: Provision a temporary WorkSpace using a clean AWS base bundle (e.g., Windows 11 Performance).
  2. Configure Master Image:
    • Log in as an Administrator.
    • Install enterprise software (Office 365, internal VPN clients, security agents).
    • Apply system updates and corporate security patches.
    • Run EC2Launch / System Preparation script cleanups.
  3. Capture Image:
    • Go to WorkSpaces Console > Select the base instance > Actions > Create Image.
    • Enter Image Name (e.g., Corp-Win11-Master-v1.0).
  4. Create Custom Bundle:
    • Navigate to Bundles > Create Bundle.
    • Select your custom image, assign hardware compute profile (e.g., Standard, Performance, Power), and set storage parameters (Root Volume: 80 GB, User Volume: 100 GB).

Step 5: Provision WorkSpaces to End Users

Option A: Manual Console Provisioning

  1. In the WorkSpaces console, choose Launch WorkSpaces.
  2. Select your registered directory.
  3. Search and select Active Directory users/groups.
  4. Assign the custom Bundle and choose running mode:
    • AlwaysOn: Billed at a fixed monthly rate. Ideal for full-time workers requiring instant connection.
    • AutoStop: Automatically stops after a configurable idle time (e.g., 1 hour) to save costs. Ideal for part-time or shift workers.
  5. Review and launch. Users will receive an automated invitation email with activation instructions.

Option B: Automated Provisioning via AWS CLI

Bash

aws workspaces create-workspaces --workspaces \
  DirectoryId=d-906712345a,UserName=john.doe,BundleId=wsb-12345678,VolumeEncryptionProperties={UserVolumeEncrypted=true,RootVolumeEncrypted=true},UserVolumeEncryptionEnabled=true,RootVolumeEncryptionEnabled=true,WorkspaceProperties={RunningMode=AUTO_STOP,RunningModeAutoStopTimeoutInMinutes=60}

AWS WorkSpaces Setup Tutorial This video demonstrates how to set up an Amazon WorkSpaces instance from scratch in the AWS console, making it a great visual supplement to the step-by-step deployment guide in your blog post.

Amazon Workspaces Training Tutorial Bootcamp
A comprehensive hands-on tutorial covering Active Directory integration, protocol selection (PCoIP vs. WSP), custom image building, and volume expansion.

🔒 4. Enterprise Security, Governance & Best Practices

┌────────────────────────────────────────────────────────────────────────┐
│                   ENTERPRISE SECURITY & COMPLIANCE                     │
├───────────────────┬────────────────────┬───────────────────────────────┤
│ Encryption        │ Access Control     │ Profile & Data Persistence    │
│ • KMS at rest     │ • RADIUS / MFA     │ • Amazon FSx for Windows      │
│ • TLS 1.2 in-tr.  │ • IP Access Control│ • OneDrive / S3 Sync          │
└───────────────────┴────────────────────┴───────────────────────────────┘

1. Encryption at Rest & In-Transit

  • At Rest: Enable KMS encryption for both Root (C:\) and User (D:\) volumes. Use Customer Managed Keys (CMK) for centralized key rotation and regulatory compliance.
  • In Transit: All pixel streaming traffic (WSP/PCoIP) is encrypted using TLS 1.2 and AES-256 bits.

2. Multi-Factor Authentication (MFA)

Integrate an on-premises RADIUS server (e.g., Cisco ISE, Duo, Microsoft NPS) with your AWS Directory Service to enforce MFA during user login.

3. User State Persistence & Profile Management

  • WorkSpaces persist user profile data on the User Volume (D:\).
  • For non-persistent or multi-user desktop deployments, integrate Amazon FSx for Windows File Server with FSLogix Profile Containers to deliver fast login times and synchronized user states.

4. Disaster Recovery & Multi-Region Resiliency

Deploy standby WorkSpaces in a secondary AWS Region using Amazon WorkSpaces Multi-Region Resilience. Use cross-region AD Connector or Multi-Region AWS Managed Microsoft AD to ensure users can failover seamlessly using the same credentials.

📊 Summary: Architecture Reference Checklist

Architecture DomainRecommended Enterprise Standard
ProtocolWorkSpaces Streaming Protocol (WSP)
Network2 Private Subnets across 2 AZs + NAT Gateway
IdentityAD Connector or AWS Managed Microsoft AD + RADIUS MFA
Compute StrategyCustom Bundles (Windows 11 / Amazon Linux 2)
StorageKMS-Encrypted Root (80 GB) + User Volume (100 GB+)
Cost OptimizationAutoStop mode for part-time; AlwaysOn for core staff

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top