Skip to main content

Amazon WorkSpaces FAQs

Page topics

General

Open all

Amazon WorkSpaces is a managed, secure cloud desktop service. You can use Amazon WorkSpaces to provision either Windows or Linux desktops in just a few minutes and quickly scale to provide thousands of desktops to workers across the globe. You can pay either monthly or hourly, just for the WorkSpaces you launch, which helps you save money when compared to traditional desktops and on-premises VDI solutions. Amazon WorkSpaces help you eliminate the complexity in managing inventory, OS versions and patches, and Virtual Desktop Infrastructure (VDI), which helps simplify your desktop delivery strategy. With Amazon WorkSpaces, your users get a fast, responsive desktop of their choice that they can access anywhere, anytime, from any supported device.

An Amazon WorkSpace is a cloud-based virtual desktop that can act as a replacement for a traditional desktop. A WorkSpace is available as a bundle of operating system, compute resources, storage space, and software applications that allow a user to perform day-to-day tasks just like using a traditional desktop.

A user can connect to a WorkSpace from any supported device using the free Amazon WorkSpaces client application on supported devices including Windows and Mac computers, iPads, and Android tablets. Users will connect using credentials set up by an administrator or using their existing Active Directory credentials if you’ve chosen to integrate your Amazon WorkSpaces with an existing Active Directory domain. Once the user is connected to a WorkSpace they can perform all the usual tasks they would do on a desktop computer.

To get started with Amazon WorkSpaces, you will need an Amazon Web Services account. You can use this account to sign into the Amazon Web Services Management Console and you can then quickly provision Amazon WorkSpaces for yourself and any other users in your organization who might require one. To provision an Amazon WorkSpace, first select a user from your directory. Next, select an Amazon WorkSpaces bundle for the user. The Amazon WorkSpaces bundle specifies the resources you need, which desktop operating system you want to run, how much storage you want to use and the software applications you want prepackaged. Finally, choose a running mode for their Amazon WorkSpace – pick AlwaysOn if you want to use monthly billing, or AutoStop if you want to use hourly billing. Once your WorkSpace is provisioned, the user will receive an email with instructions for connecting to their WorkSpace. You can use this same process to provision multiple WorkSpaces at the same time.

You can find the latest information on Amazon WorkSpaces bundles here.

Amazon WorkSpaces offers Amazon Linux WorkSpaces built on Amazon Linux 2 LTS, Windows 10 desktop experiences. You can choose if your Windows 10 desktop experience is powered by Windows Server 2016 or Windows Server 2019. If your organization is eligible to bring their own Windows Desktop licenses, you can run the Windows 10 Enterprise operating system on your Amazon WorkSpaces.

For Amazon Linux WorkSpaces, root volume is mapped to /, and user volume is mapped to /home.

For Windows, root volume is mapped to C: drive, and user volume is mapped to D: drive.

When Amazon WorkSpaces are provisioned, users receive an email providing instructions on where to download the WorkSpaces clients they need, and how to connect to their WorkSpace. If you are not integrating with an existing Active Directory, the user will have the ability to set a password the first time they attempt to connect to their WorkSpace. If the Amazon  Directory Services AD Connector has been used to integrate with an existing Active Directory domain, users will use their regular Active Directory credentials to log in.

A user needs to have an Amazon WorkSpace provisioned for them, and a broadband Internet connection. To use an Amazon WorkSpaces client application to access their WorkSpace, they will need a supported client device (PC, Mac, iPad, or Android tablet), and an Internet connection with TCP ports 443 & 4172, and UDP port 4172 open.

An administrator can control what a user can personalize in their WorkSpace. By default, users can personalize their WorkSpaces with their favorite settings for items such as wallpaper, icons, shortcuts, etc. These settings will be saved and persist until a user changes them. If an administrator wishes to lock down a WorkSpace using tools like Group Policy for Windows, this will restrict a user’s ability to personalize their WorkSpaces.

By default, users are configured as local administrators of their WorkSpaces. Administrators can change this setting and can restrict users’ ability to install applications with a technology such as Group Policy.

Yes. Each WorkSpace runs on an individual instance for the user it is assigned to. Applications and users’ documents and settings are persistent.

No. An Amazon Web Services account is only needed to provision WorkSpaces. To connect to WorkSpaces, users will require only the information provided in the invitation email they will receive when their WorkSpace is provisioned.

If you are located more than 2000 miles from the regions where Amazon WorkSpaces is currently available, you can still use the service, but your experience may be less responsive. The easiest way to check performance is to use the Amazon WorkSpaces Connection Health Check Website. 

Yes, public APIs are available for creating and managing Amazon WorkSpaces programmatically. APIs are available via the Amazon CLI and SDK; you can learn more about the APIs in the documentation.

Yes. The first time set up for Amazon WorkSpaces relies on the Amazon Web Services Management Console. Once you have created a directory and registered it with the Amazon WorkSpaces service, you can create and manage WorkSpaces using the Amazon WorkSpaces APIs.

Bundles and Custom Images

Open all

Amazon Linux WorkSpaces come with a curated selection of applications at no additional cost that include LibreOffice, Firefox Web Browser, Evolution mail, Pidgin IM, GIMP, and other desktop utilities and tools. You can always add more software from the Amazon Linux repositories using yum. To install an available package from the Amazon Linux repositories, simply type “yum install [package-name]”. You can also add software from RPM based public and private Linux repositories at any time.

A: Amazon WorkSpaces come with a default set of applications at no additional cost. For an additional monthly fee, you can choose to have 32-bit Office 2016 Professional plus and Trend Micro Worry-Free Business Security installed by default on your WorkSpaces powered by Windows Server 2016. Or, have the following applications installed by default on your WorkSpaces powered by Windows Server 2019 and Windows Server 2022.

  • Microsoft Office Professional Plus 2019
  • Microsoft Office LTSC Professional Plus 2021
  • Microsoft Visio LTSC Professional 2021
  • Microsoft Project Professional 2021
  • Microsoft Office LTSC Standard 2021
  • Microsoft Visio LTSC Standard 2021
  • Microsoft Project Standard 2021

In addition, WorkSpaces powered by Windows Server 2022 supports following applications. 

  • Microsoft Visual Studio Professional 2022
  • Microsoft Visual Studio Enterprise 2022

For more information on how to manage these applications on your WorkSpaces, refer to Manage Applications.

A: Yes, as an administrator you can create a custom image from a running WorkSpace. Once you have customized your WorkSpace with your applications and settings, select the WorkSpace in the console and select “Create Image.” This creates an image with your applications and settings. Custom images created from Amazon WorkSpaces with GPU-enabled bundles (Graphics.g4dn and GraphicsPro.g4dn) can only be used with graphics bundles. Custom images created from Value, Standard, Performance, Power, or PowerPro bundles can only be used with those bundles.  Most See the custom image WorkSpace images are available within 45 minutes. documentation for more detail.

To launch an Amazon WorkSpace from a custom image, you will first need to pair the custom image with a hardware type you want that WorkSpace to use, which results in a bundle. You can then publish this bundle through the console, then select the bundle when launching new WorkSpaces.

An image contains only the OS, software and settings. A bundle is a combination of both that image and the hardware from which a WorkSpace can be launched.

As an administrator, you can create as many custom images as you need. Amazon WorkSpaces sets default limits, but you can request an increase in these limits here. To see the default limits for Amazon WorkSpaces, please visit our documentation.

Yes. You can update an existing bundle with a new image that contains the same tier of software (for example containing the Plus software) as the original image.

All Amazon WorkSpaces are built on general purpose solid-state drives (SSD) EBS volumes for both root and user volumes.

You have flexibility in how you deploy the right set of applications to users. First, you choose which image type to build from, either basic or Plus, which determines the default applications that will be in the WorkSpaces. Second, you can install additional software on a WorkSpace and create a custom image which can be used to launch more WorkSpaces. For more detail see the bundle documentation.

A: For Amazon Linux, any application available in the Amazon Linux repositories is compatible and can be installed using yum install [package-name].

For Ubuntu WorkSpaces, you can install applications using Ubuntu Software by clicking its icon in the Dock or search for “Software” in the Activities search bar.

For Windows, any applications that are compatible with the operating system should run on your WorkSpaces. We recommend testing any software you would like to deploy on a "test" WorkSpace before delivering it to more users. You are responsible for ensuring that you remain compliant with any licensing restrictions associated with any software you intend to install on a WorkSpace.

A: You can share custom images created from a Windows desktop experience powered by Windows Server 2016, 2019 or 2022, or Linux WorkSpaces with any Amazon Web Services account. BYOL images can only be shared with other accounts that have the same Amazon Web Services payer account ID.

The Graphics bundles are well-suited for general-purpose graphics workloads, such as virtual desktops for office productivity and modern web applications. Each Graphics bundle comes with an NVIDIA GPU with 1,536 CUDA cores and 4 GB of video memory. Each Graphics bundle includes 8 vCPUs, 15 GiB of RAM, 4 GB of video memory, and 100 GB of storage on the user volume, and 100 GB of general-purpose persistent storage on the root volume. Graphics bundles provide a Windows desktop experience. Effective November 30, 2023, the Graphics bundle is no longer supported. We recommend migrating to the Graphics.g4dn bundle for WorkSpaces.

GPU-Enabled Bundles

Open all

A: Yes. Amazon WorkSpaces offers Graphics G4dn family.

The Graphics G4dn family includes two bundle options - Graphics.g4dn and GraphicsPro.g4dn. Both are based on the EC2 G4dn instances- the industry’s well-known versatile GPU instances for graphics applications that rely on NVIDIA GPU libraries such as OptiX. A Graphics.g4dn bundle is the good price performance in the cloud for mainstream graphics-intensive applications, such as engineering, design, and architectural applications. The GraphicsPro.g4dn bundle is for high-end graphics applications, such as media production, seismic visualization, and small-scale ML model training, and ML inference. See EC2 instance type page for more details about G4dn instances and NVIDIA T4 GPUs.

A: GPU-enabled bundles from Amazon WorkSpaces are cloud desktops optimized for workloads that benefit from graphics acceleration. You can choose the Graphics.g4dn or the GraphicsPro.g4dn bundle, depending on the performance requirements of your graphics workload and your cost requirements. 

Graphics G4dn family includes two bundle options - Graphics.g4dn and GraphicsPro.g4dn. Both Graphics.g4dn and GraphicsPro.g4dn come with the RTX-capable NVIDIA T4 Tensor Core GPU that features multi-precision Turing Tensor Cores and RT Cores, Amazon Web Services custom second generation Intel® Xeon® Scalable (Cascade Lake) processors, up to 100 Gbps of networking throughput, and local NVMe storage designed for applications that require fast access to locally stored data. The g4dn-based bundles are optimized for streaming graphics-intensive applications that support accelerated ray tracing through NVIDIA OptiX and AI-enhanced visualization such as AI-denoising and deep learning super sampling (DLSS). These bundles can also be used for compute workloads such as data science and machine learning using NVIDIA libraries such as CUDA and NVIDIA’s GPU-accelerated deep learning frameworks. 

The Graphics.g4dn bundles are suitable for customers seeking cost-effective GPU-enabled NVIDIA RTX virtual workstations to operate mainstream graphics-intensive applications, such as computer-aided design (CAD), simulation, and geospatial information systems (GIS)  applications. A Graphics.g4dn bundle provides g4dn.xlarge instance with 4vCPUs, 16 GB of RAM, 16 GB of video memory, 125 GB of temporary NVMe SSD local instance store, and a minimum 100 GB of persistent storage for the user volume and root volumes. Graphics.g4dn bundles provide a Windows 10 virtual workstation experience.

The GraphicsPro.g4dn bundles are designed for high-end graphics workloads, such as media production, rendering, data science, architectural, and  seismic visualization applications. Additionally, they are well suited for compute workloads including intelligent video analytics (IVA), small-scale ML model training, and ML inference. A graphicsPro.g4dn bundle offers 16vCPUs, 64 GB of RAM, 16 GB of video memory, 225 GB of temporary NVMe SSD local instance store, and a minimum 100 GB of persistent storage for the user volume and root volumes. GraphicsPro.g4dn bundles provide a Windows 10 virtual workstation experience. See EC2 instance type page for more details about G4dn instances and NVIDIA T4 GPUs.

A: Yes. Custom images created from a GPU-enabled Amazon WorkSpaces bundle can only be used with the same type of bundle. For instance, you can use an image made from a Graphics.g4dn bundle to launch a GraphicsPro.g4dn WorkSpace. However, you cannot use an image made from a Graphics.g4dn bundle to launch a PowerPro WorkSpace 

A: You can launch Graphics.g4dn or GraphicsPro.g4dn bundles using the Amazon WorkSpaces Management Console or the Amazon WorkSpaces API. When launching a new WorkSpace, simply select the corresponding graphics bundle name. You may need to request for a quota increase before launching the GPU-enabled bundles.

A: Bandwidth used by GPU-enabled Amazon WorkSpaces bundles depends on the tasks being performed. If there aren’t many changes taking place on the screen, the bandwidth used is generally less than 300 kbps. If there is context switching between multiple windows, or if 3D models are being manipulated, bandwidth use can increase to several megabits per second.

A: No. Amazon WorkSpaces does not currently offer a GPU-enabled WSP bundle.

A: All GPU-enabled WorkSpaces bundles come with a minimum 100 GB of persistent storage for the user volume and root volumes. You can select the amount of storage that you need for both root and user volumes when you launch new WorkSpaces, and you can increase storage allocations at any time. Data that users store on the “user volume” attached to the WorkSpace is automatically backed up to Amazon S3 on a regular basis. 

Graphics G4dn bundles also come with local NVMe-based SSD storage known as the instance store. The instance store is ideal for temporary content like caches and buffers, because the data stored in instance store volumes is not persistent through instance stops, terminations, or hardware failures. Graphics.g4dn offers 125 GB of local instance storage and GraphicsPro.g4dn provides 225 GB of local instance store. You cannot change the size of local instance store. You will find the local instance store volume named as “E:\Temp_SSD” on your WorkSpace. Learn more about instance store lifetime, see Amazon EC2 Instance Store.

Windows BYOL

Open all

Yes, you can bring your own Windows 10 desktop licenses to WorkSpaces if they meet Microsoft’s licensing requirements. WorkSpaces gives you an option to run Windows 10 desktop images on physically dedicated hardware, which lets you maintain license compliance for your Windows desktops when you bring your own licenses to WorkSpaces.

If your organization meets the licensing requirements set by Microsoft, you can bring your Windows 10 Enterprise or Professional licenses to Amazon WorkSpaces. You cannot use Windows OEM licenses for your Amazon WorkSpaces. Please consult with Microsoft if you have any questions about your eligibility to bring your own Windows Desktop licenses.

By bringing your own Windows Desktop licenses to Amazon WorkSpaces, you will save WorkSpaces costs per month when being billed monthly, and you will save money on the hourly usage fee when being billed hourly (see the Amazon WorkSpaces pricing page for more information). Additionally, you can now use a single golden image to manage your physical and virtual desktop deployments.

You need an active and eligible Microsoft Volume Licensing (VL) agreement with Software Assurance contracts to bring your Windows 10 Desktop licenses to Amazon WorkSpaces. Please consult with your Microsoft representative to confirm your eligibility in bringing your Windows Desktop licenses to Amazon WorkSpaces.

In order to ensure that you have adequate dedicated capacity allocated to your account, please reach out to your Amazon Web Services  account manager or sales representative to enable your account for BYOL. alternatively, you can create a Technical Support case with Amazon WorkSpaces to get started with BYOL.

Once enabled for your account, it’s easy to bring your existing Windows 10 Desktop OS to Amazon WorkSpaces. First, import your existing Windows desktop OS using the VM Import API. Then create your new WorkSpaces image, based on the imported VM, using the Create Image action on the Images page in the Amazon WorkSpaces Console. Finally, create a custom WorkSpaces bundle using the Bundles tabs in the WorkSpaces Admin Console. You can then launch your newly created custom WorkSpaces bundle as new WorkSpaces for your users through the WorkSpaces Management console.

You can see more information on the BYOL process in our documentation.

You can activate your Windows 10 Desktop operating system using existing Microsoft activation servers that are hosted in your VPC, or ones that can be reached from the VPC in which Amazon WorkSpaces are launched.

Yes. You can use the standard WorkSpaces image management functionality to further customize the Windows 10 Desktop image and save it as a new Amazon Workspaces image in your account.

No. Your custom WorkSpaces that support BYOL for Windows 10 Desktops are launched on physically dedicated hardware to meet license compliance requirements with Microsoft. WorkSpaces launched in a directory marked for dedicated hardware can only be from the custom bundle you created that has your Windows 10 Desktop image.

If you wish to launch WorkSpaces from public bundles to users in the same domain, you can create a new  Amazon Web Services AD Connector directory that points to the same Microsoft Active Directory as your Windows 10 Desktop WorkSpaces, and launch WorkSpaces in that directory as you normally would through the Amazon Web Services Management Console or the WorkSpaces SDK and CLI.

A: Yes, you can. Please contact us if this is something you’d like to do.

Yes, you need to commit to running 200 Amazon WorkSpaces in a region per month on hardware that is dedicated to you. If you want to bring your own Windows desktop licenses for graphics use cases, you need to commit to at least 4 monthly or 20 hourly GPU-enabled WorkSpaces.

It can take a few hours after you perform the “Create Image” operation for your custom Windows desktop image to be available to use. You can check the status of your custom image in the WorkSpaces Console, API, or CLI.

No. Amazon WorkSpaces launched on dedicated hardware will be balanced across two AZs. You select the AZs for Amazon WorkSpaces when you create the directory in which your Amazon WorkSpaces will be launched, and subsequent launches of Amazon WorkSpaces are automatically load balanced across the AZs selected when you created the directory.

You can terminate Amazon WorkSpaces when you no longer need them. You will only be billed for the Amazon WorkSpaces that are running.

Amazon WorkSpaces that are rebuilt, restored, or restarted can be placed on any available physical server allocated to your account. A restart, restore, or rebuild of an Amazon WorkSpace can result in that instance being placed on a different physical server that has been allocated to your account.

A: For Microsoft Office 2016 or 2019 you can subscribe during BYOL image import. Office is automatically installed in the image during image creation. You can use this image spin up WorkSpaces and all those WorkSpace will be subscribed to Microsoft Office 2016 or 2019 based on your selection. 

For Microsoft Office / Visio / Project 2021 and Visual Studio 2022, the BYOL import option is not applicable. You do not need to subscribe to these applications during BYOL import. You can directly install these applications on your WorkSpaces. For more information, refer to Manage Applications.

A: You can subscribe to applications such as Microsoft Office, Visual Studio, Visio or Project for your WorkSpaces. WorkSpaces launched from a BYOL image with these applications enabled incur the listed fee for these applications every month irrespective of whether you use that WorkSpace in that month. You will not be billed for BYOL images with these applications enabled, only the WorkSpaces created from an image with these applications enabled. For more information on pricing for the Office, Visual Studio, Visio, or Project, visit Amazon WorkSpaces pricing page.

A: During BYOL image import operations, you have the option to select Microsoft Office Professional 2016 or 2019 for Windows 10 BYOL WorkSpaces and Microsoft Office Professional 2019 for Windows 11 BYOL WorkSpaces. You can also install following applications on your existing WorkSpaces.

  • Microsoft Office LTSC Professional Plus 2021
  • Microsoft Visio LTSC Professional 2021
  • Microsoft Project Professional 2021
  • Microsoft Office LTSC Standard 2021
  • Microsoft Visio LTSC Standard 2021
  • Microsoft Project Standard 2021
  • Microsoft Visual Studio Professional 2022
  • Microsoft Visual Studio Enterprise 2022

After you have created a BYOL image with the Office bundle installed, you can use the Amazon WorkSpaces migrate feature to migrate your existing BYOL WorkSpaces to ones with the Office bundle. All data in the latest snapshot of the original user volume will be retained after migration and the C drive will be newly created from the new image. You can migrate a WorkSpace created from a bundle that does not have Office provided by Amazon Web Services to another WorkSpace created from a bundle that has Amazon Web Services provided Microsoft Office and vice versa. Data on both root and user volumes are preserved upon migration.

Alternatively, you can use “Manage Applications” workflow to add or remove applications to or from your existing WorkSpaces. This option is applicable only for Office 2021, whereas the migration workflow will work for all the Office bundles. 

Office updates are included as part of your regular Windows updates. Our image creation process will pick up the latest updates during the creation process. We recommend that you periodically update your Windows base images to stay current on all security patches and updates.

Storage and Hardware Bundles

Open all

Yes. You can increase the size of the root and user volumes attached to your WorkSpaces at any time. When you launch new WorkSpaces, you can select bundled storage configurations for root and user volumes, or choose your preferred storage size greater than the provided storage configurations. For storage configurations with 80 GB Root volume, you can choose 10 GB, 50 GB or 100 GB for User volume. You can use storage configurations with 175 GB to 2000 GB Root volume along with 100 GB to 2000 GB User volume. Please note that you need to set the Root volume to 175 GB in order to expand the User volume in the range of 100GB to 1000GB. After your WorkSpaces have been launched, you can only increase the size of the volumes using the above configurations to up to 2000 GB for each Root and User volume.

No. To ensure that your data is preserved, the volume sizes of either volume cannot be reduced after a WorkSpace is launched. You can launch a Value, Standard, Performance, Power or PowerPro WorkSpace with a minimum of 80 GB for the root volume and 10 GB for the user volume. You can launch a For more information about configurable storage, see GPU-enabled WorkSpace with a minimum of 100 GB for the root volume and 100 GB for the user volume. Modifying WorkSpaces.

In addition to the persistent storage for the root volume and the user volume, Graphics.g4dn offers 150 GB of temporary local storage and GraphicsPro.g4dn provides 225 GB of temporary local storage. You cannot change the size of the temporary local storage. You will find the temporary local storage volume named as “E:\Temp_SSD” on your WorkSpace. Learn more about instance store lifetime, see Amazon EC2 Instance Store.

You can change the size of your storage volumes via the Amazon WorkSpaces management console, or through the Amazon WorkSpaces API.

WorkSpaces users can also increase the size of their storage volume directly in the WorkSpaces client if this self-service management capability is enabled by the WorkSpaces administrator. 

Yes, each rebuild preserves the storage allocation size for WorkSpaces when using default bundles. If a WorkSpace has its volumes extended, and is rebuilt, the larger volume sizes will be preserved, even if the bundle's drive sizes are smaller.

Yes, each Restore preserves your existing storage allocation size when using WorkSpaces default bundles. For example, restoring a WorkSpace with 80GB Root and 100GB User volumes will result in a rebuilt WorkSpace with 80GB Root and 100GB User.

If the storage allocation of a Custom bundle is increased and a linked WorkSpace is restored, the WorkSpace volumes will be increased to match the bundle’s new volume sizes.

All data in the latest snapshot of the original user volume will be retained. For a Windows WorkSpace, the D drive data captured by the latest snapshot will be retained after migration and the C drive will be newly created from the target bundle image. In addition, migrate attempts to move data from the old user profile to the new one. Data that cannot be moved to the new profile will be preserved in a .notMigrated folder. For more information, please refer to the documentation.

Yes. The WorkSpaces migrate function allows you to replace your WorkSpace’s root volume with a base image from another bundle. Migrate will recreate the WorkSpace using a new root volume from the target bundle image, and the user volume from the latest original user volume snapshot. For detailed information about migrate, please refer to the documentation.

WorkSpaces Migrate allows you to switch to a new bundle and have your user profile regenerated. Rebuild just refreshes your WorkSpace with a root volume generated from the base image of the original bundle.

Migrate associates your WorkSpace with a new bundle. And a rebuild after migration will uses the newly associated bundle to generate the root volume.

The root volume size of WorkSpaces launched from a custom image is, by default, the same size as the custom image. For example, if your custom image has a root volume of 100 GB, all WorkSpaces launched from that image also have a root volume size of 100 GB. You can increase your root volume size when you launch your WorkSpace, or any time after that.

Yes. You can switch between Value, Standard, Performance, Power, or PowerPro bundles by using the Amazon WorkSpaces management console or the WorkSpaces API. When you switch hardware bundles, your WorkSpaces restart immediately. When they resume, your operating system, applications, data, and allocated storage on both the root and user volumes are all preserved.

For example, you can launch a Standard bundle (2vCPU, 4 GiB), and later expand the volume size on both volumes to 500 GB. You can then switch to the Performance bundle (2vCPU, 7.5 GiB) while preserving your operating system, applications, and data in the expanded volume.

Users can also change their WorkSpaces bundle directly from the WorkSpaces client if this self-service management capability is enabled by their WorkSpaces administrator. 

You can use Amazon CloudTrail to track the changes that you have requested.

Yes. You can take advantage of both these features even if you bring your own Windows desktop licenses. By default, you can switch WorkSpaces bundles for up to 20% of the total number of your WorkSpaces in a week. To switch more than 20% of your WorkSpaces, contact us.

No. When you make a change, we start a WorkSpace that isn’t running, apply the bundle change, restart it so that the changes take effect, and then stop it again.

For example, you change the bundle type on a stopped Standard (2vCPU, 4 GiB) WorkSpace to Performance. We start your Standard WorkSpace, apply the bundle change, and restart it. Following the restart, your WorkSpace has Performance hardware (2vCPU, 7.5 GiB).

For either change, you get charged the monthly price for AlwaysOn or the monthly fee for AutoStop WorkSpaces prorated on a per day basis.

For example, if you increase the volume on the 10th of a month on an AlwaysOn Power WorkSpace with 175 GB, and 100 GB for root and user volumes respectively, you are charged the monthly price for the Power WorkSpace and the 20-day costs of additional 175 GB. Similarly, switching a bundle—for example, from Value to Standard—on the 15th of a month results in 15 days of Value WorkSpaces charge and 15 days of Standard WorkSpaces charge.

You can increase volume sizes or change a WorkSpace to a larger hardware bundle once in a 6-hour period. You can also change to a smaller hardware bundle once in a 30-day period. For a newly launched WorkSpace, you must wait 6 hours before requesting a larger bundle.

For example, if you increase the root and user volume of a Standard WorkSpace on 5th Dec at 11:00 AM and change it to Performance WorkSpace at the same time, on 5th Dec at 4:00 PM, you can again increase the root and user volume, and change the hardware bundle. If you change the Performance WorkSpace to a Standard WorkSpace on 6th Dec at 12:00 and want to go to a further smaller bundle (Value), you would be able to make this change on 6th Jan at 12:00.

A: Yes, you can. Please contact us if this is something you’d like to do.

A: Yes, you need to commit to running 200 Amazon WorkSpaces in a region per month on hardware that is dedicated to you. If you want to bring your own Windows desktop licenses for graphics use cases, you need to commit to at least 4 monthly or 20 hourly GPU-enabled WorkSpaces.

Amazon Linux WorkSpaces

Open all

Amazon Linux WorkSpaces are enterprise ready cloud desktops that organizations can provide to developers, engineers, students or office workers to get their work done.

Developers can develop software with their favorite applications like Amazon CLI, Amazon SDK tools, Visual Studio Code, Eclipse and Atom. Analysts can run simulations using MATLAB and Simulink. Office workers can use pre-installed applications like LibreOffice for editing documents, spreadsheets, and presentations, Evolution for email, Firefox for web browsing, GIMP for image editing, Pidgin for instant messaging, and many others. You can always install more applications from the Amazon Linux repositories or other RPM based Linux repositories.

Amazon Linux WorkSpaces include a selection of desktop utilities and tools, development tools, and general productivity applications. Developers can quickly get started using packages like OpenJDK 8, Python, C/C++, Amazon CLI, and Amazon SDK. General office workers can use Libre Office for document editing, spread sheets, and presentations, Firefox for web browsing, GIMP for photo editing, Pidgin for IM, Evolution for mails, Atril for PDF documents and more for day to day productivity tasks. You can always install more applications from the Amazon Linux repositories or from other RPM based Linux repositories.

To get started, simply create or select users from your configured directory, select Amazon Linux WorkSpaces bundles, and launch. Your users will receive instructions via email for connecting to their WorkSpaces. Please click here for the list of available hardware bundles.

Amazon Linux WorkSpaces are available with both the hourly and monthly billing options. Detailed pricing is available here.

Amazon Linux is RPM based and uses yum package manager.

Amazon Linux WorkSpaces are connected to the Amazon Linux core and extras repositories. You can always add other RPM based Linux repositories.

Amazon Linux WorkSpaces are regularly patched and updated from the Amazon Linux repositories.

Amazon Linux WorkSpaces currently support Active Directory, an on-premises directory available via AD Connector and Microsoft Active Directory on Amazon Web Services.

Yes. You can customize settings and install additional software on Amazon Linux WorkSpaces. You can also create custom images using the Amazon WorkSpaces console or API and use those images to launch WorkSpaces with your customizations for other users in your organization.

By default, Amazon Linux WorkSpaces users get sudo access while root user is disabled for them. You can always modify permissions by editing /etc/sudoers file.

Compliance and Security

Open all

Users sign into their WorkSpace using their own unique credentials, which they can create after a WorkSpace has been provisioned for them. If you have integrated the Amazon WorkSpaces service with an existing Active Directory domain, users will sign in with their regular Active Directory credentials. Amazon WorkSpaces also integrates with your existing RADIUS server to enable multi-factor authentication (MFA).

Yes. You can restrict access to Amazon WorkSpaces based on the client OS type, and using digital certificates. You can choose to block or allow macOS, Microsoft Windows, iOS, Android, Chrome OS, and zero client.

A digital certificate is a digital form of identity that is valid for a specified period of time, which is used as a credential that provides information about the identity of an entity, as well as other supporting information. A digital certificate is issued by a certificate authority (CA), and the CA guarantees the validity of the information in the certificate.

Digital certificates can be used to block or allow WorkSpaces access from MacOS and Microsoft Windows client devices.

To use digital certificates to block or allow access to Amazon WorkSpaces, you upload your root certificates to the WorkSpaces management console and distribute your client certificates to the macOS and Windows devices you want to trust. To distribute your client certificates, use your preferred solution such as Microsoft System Center Configuration Manager (SCCM), or Mobile-Device Management (MDM) software. For more information, see Restrict WorkSpaces Access to Trusted Devices.

For each Amazon WorkSpaces directory, you can import up to two root certificates each for MacOS and Microsoft Windows devices. If two root certificates are imported, WorkSpaces will present both root certificates to the client device, and the client device will use the first certificate that chains up to either root certificate.

Yes. You can control access to Amazon WorkSpaces using the device type only.

At this time Amazon WorkSpaces can use digital certificates only with MacOS and Microsoft Windows client devices.

Multi-Factor Authentication adds an additional layer of security during the authentication process. Users must validate their identity by providing something they know (e.g. password), as well as something they have (e.g. hardware or software generated one-time password (OTP).

Amazon supports one time passwords that are delivered via software tokens. Out of band tokens, such as SMS tokens are not currently supported.

MFA is available for Amazon WorkSpaces client applications on the following platforms - Windows, Mac OS X, iOS, Android, and PCoIP Zero Clients.

If either AD Connector or Amazon Web Services Microsoft AD is used to integrate with an existing Active Directory domain, the user would follow your existing lost password process for your domain, such as contacting an internal helpdesk. If the user is using credentials stored in a directory managed by the WorkSpaces service, they can reset their password by clicking on the “Forgot Password” link in the Amazon WorkSpaces client application.

You can install your choice of anti-virus software on your users’ WorkSpaces. The Plus bundle options offer users access to anti-virus software, and you can find more details on this here. If you choose to install your own anti-virus software, please ensure that it does not block UDP port 4172, as this will prevent users connecting to their WorkSpaces.

To remove a user’s access to their WorkSpace, you can disable their account either in the directory managed by the WorkSpaces service, or in an existing Active Directory that you have integrated the WorkSpaces service with.

Yes. Please see our documentation.

Yes. You can set a default Organizational Unit (OU) in which computer accounts for your WorkSpaces are created in your Active Directory. This OU can be part of the domain to which your users belong, or part of a domain that has a trust relationship with the domain to which your users belong, or part of a child domain in your directory. Please see our documentation for more details.

Yes. You can use Amazon VPC Security groups to limit access to resources in your network or the Internet from your WorkSpaces. You can select a default Amazon VPC Security Group for the WorkSpaces network interfaces in your VPC as part of the directory details on the WorkSpaces console. Please see our documentation for more details.

An IP Access Control Group is a feature that lets you specify trusted IP addresses that are permitted to access your WorkSpaces. An Access Control group is made up of a set of rules, each rule specifies a specific permitted IP address or range of addresses. you can create up to 25 IP Access Control groups with up to 10 rules per group specifying the IP addresses or IP ranges accessible to your Amazon WorkSpaces.

Yes. With this feature you can create up to 25 IP Access Control groups with up to 10 rules per group specifying the IP addresses or IP ranges accessible to your Amazon WorkSpaces.

You will have two ways to do this:

  1. 1. From the WorkSpaces management console on the ‘IP Access Controls’ page, you can create access control groups by selecting ‘Create IP Access Control Groups’ and entering a group name and description. You can then add rules to your IP Access Control Group by selecting the group and going to the Rules tab, selecting ‘Edit’ and adding up to 10 rules, entering the IP addresses to allow along with a description of each rule. You can apply your IP Access Control Groups to WorkSpaces Directories on the ‘Update Directory Details’ page. See IP Access Control Groups for details.
  2. From the Amazon Command Line Interface you can call Amazon WorkSpaces APIs to create, delete, and describe groups, create and delete rules from each group, and to add and remove groups from directories. See Amazon WorkSpaces API Reference for details.

Yes. This feature can be used with the MacOS, iPad, Windows desktop, and Android tablet clients. This feature also supports zero clients using MFA.

Zero Clients using MFA can be used with IP Based Access Controls, along with any compatible Zero Clients which do not use PCoIP Connection Manager to connect to WorkSpaces. Any connections through PCoIP Connection Manager will not be able to access WorkSpaces if IP Based Access Controls are enabled.

You will need to whitelist your public IPs with this feature, so if you have a NAT, you will need to allow access from the IPs coming from it. In this case you will be allowing access any time a user accesses WorkSpaces through a NAT.

WorkSpaces supports the use of the URI (uniform resource identifier) WorkSpaces:// to open the WorkSpaces client and optionally enter the registration code, user name, and/or multi-factor authentication (MFA) code (if MFA is used by your organization).

You can create your unique URI links by following the WorkSpaces URI formatting documented in Customize How Users Log in to their WorkSpaces in the Amazon WorkSpaces Administration Guide. By providing these links to users, you enable them to use the URI on any device that has the WorkSpaces client installed. URI links can contain human-readable sensitive information if you choose to include the registration code, user name, and/or MFA information, so take precautions with how and whom you share URI information.

Q. How can I securely implement a URI for my WorkSpaces users?

WorkSpaces URIs are ideal for organizations that have an existing secure internal landing page or service portal where users access their applications. You can customize and then share the WorkSpaces URI to the portal, which gives users an easy way to access their WorkSpaces without requiring them to enter their user name and MFA multiple times or label their URI to remember which WorkSpaces registration code belongs which directory.

Encryption

Open all

Yes. Amazon WorkSpaces supports root volume and user volume encryption. Amazon WorkSpaces uses EBS volumes that can be encrypted on creation of a WorkSpace, providing encryption for data stored at rest, disk I/O to the volume, and snapshots created from the volume. Amazon WorkSpaces integrates with the Amazon KMS service to allow you to specify the keys you want to use to encrypt the volumes.

A: Encryption is supported on all Amazon WorkSpaces hardware and software bundle types. This includes the Windows desktop experiences, and the Value, Standard, Performance, Power, PowerPro, Graphics, GraphicsPro, Graphics.g4dn, and GraphicsPro.g4dn bundles. It also includes all Plus application bundles. Additionally, any custom bundles also support encryption.

When creating a new Amazon WorkSpace from the console or the Amazon WorkSpaces APIs, you will have the option to specify which volume(s) you want encrypted along with a key ARN from your KMS keys for encryption. Note that during the launch of a WorkSpace, you can specify whether you want encryption for the user volume, root volume or both volumes, and the key provided will be used to encrypt the volumes specified.

The root and user volumes are encrypted using a single key.

You can use the same KMS key to encrypt the volumes of up to 500 Amazon WorkSpaces.

Amazon WorkSpaces creates a default master key upon your first attempt to launch a WorkSpace through the Amazon Web Services Management Console. You cannot manage the lifecycle of default master keys. To control the full lifecycle of a key, configure WorkSpaces to use a KMS custom customer master key (CMK). To create a KMS custom CMK, visit the KMS console or use KMS APIs to create your own keys. Note that you can use a default key generated by KMS for your WorkSpaces which will be made available to you on your first attempt to launch Amazon WorkSpaces with encryption through the Amazon Web Services Management Console.

In order to use KMS keys to encrypt Amazon WorkSpaces, the key must not be disabled, and should not have exceeded its limits (learn more about limits here). You also need to have the correct permissions and policies associated with the key to use it for encryption. To learn more about the correct permissions and policies needed on the keys, please refer to our documentation.

When you launch a new WorkSpace with the key specified, the WorkSpaces service will verify if the key is valid and eligible to be used for encryption. If the key is not valid, the launch process will fail quickly and notify you of the error associated with the key. Please note that if you change the key settings while the WorkSpace is being created, there is a chance that provisioning will fail and you will be notified of this failure through the Amazon Web Services Management Console or through the DescribeWorkSpaces API call.

You will be able to see if a WorkSpace is encrypted or not from the Amazon Web Services Management Console or using the Amazon WorkSpaces API. In addition to that, you will also be able to tell which volume(s) on the WorkSpace were encrypted, and the key ARN that was used to encrypt the WorkSpace. For example, the DescribeWorkSpaces API call will return information about which volumes (user and/or root) are encrypted and the key ARN that was used to encrypt the WorkSpace.

Encryption of WorkSpaces is only supported during the creation and launch of a WorkSpace.

A running WorkSpace will not be impacted if you disable the KMS key that was used to encrypt the user volume of the WorkSpace. Users will be able to login and use the WorkSpace without interruption. However, restarts, rebuilds, and restores of WorkSpaces that were encrypted using a KMS key that has been disabled (or the permissions/policies on the key have been modified) will fail. If the key is re-enabled and/or the correct permissions/policies are restored, restarts, rebuilds, and restores of the WorkSpace will work again.

Amazon WorkSpaces does not support disabling encryption for a running WorkSpace. Once a WorkSpace is launched with encryption enabled, it will always remain encrypted.

Yes. All snapshots of the user volume will be encrypted using the same key that was used to encrypt the user volume of the WorkSpace when it was created. The user volume once encrypted stays encrypted throughout its lifecycle. Please note that Amazon WorkSpaces does not take snapshots of the root volume of a running WorkSpace.

Yes. Rebuilds of a WorkSpace will work as long as the key that was used to encrypt the WorkSpace is still valid. The WorkSpace volume(s) stay encrypted using the original key after it has been rebuilt.

Yes. A WorkSpace restore will work as long as the key that was used to encrypt the WorkSpace is still valid. The WorkSpace volume(s) stay encrypted using the original key after it has been restored.

Creating a custom image from a WorkSpace that is encrypted is not supported.

You can expect a minimum increase in latency on IOPS on encrypted volumes.

The launch time of a WorkSpace that only requires user volume encryption are similar to those of an unencrypted WorkSpace. The launch time of a WorkSpace that requires root volume encrypt will take several more minutes.

No. Encrypted resources in one region cannot be used in a different region, because a KMS key belongs to the region in which it was created.

There is no additional charge for encrypting volumes on WorkSpaces, however you will have to pay standard Amazon KMS charges for KMS API requests and any custom CMKs that are used to encrypt WorkSpaces. Please see Amazon KMS pricing here. Please note that the Amazon WorkSpaces services makes a maximum of five API calls to the KMS service upon launching, restarting or rebuilding a single WorkSpace.

Yes. You can use KMS to rotate your custom CMKs. You can configure a custom CMK that you create to be automatically rotated by KMS on an annual basis. There is no impact to WorkSpaces encrypted before the CMK rotation, they will work as expected.

Client Access and User Experience

Open all

You can download the Amazon WorkSpaces client application for free on the client download website.

No. You can use any of the free clients provided by Amazon Web Services, which includes client applications for Windows, macOS, iOS, and Android tablets, to access your Amazon WorkSpaces.

Please refer to the WorkSpaces Clients documentation.

Amazon WorkSpaces clients are available for the following devices:
• Apple iPadOS based iPad, iPad Pro, iPad Mini, iPad Air
• Android-compatible Chrome OS devices 
• Android phones and tablets
While we expect other popular Android tablets running Android version 8.1 to work correctly with the Amazon WorkSpaces client, there may be some that are not compatible. If you are interested in support for a particular device, please let us know via the Amazon WorkSpaces forum.

A PC-over-IP (PCoIP) Zero Client is a single-purpose hardware device that can enable access to Amazon WorkSpaces. Zero Clients include hardware optimization specifically for the PCoIP protocol, and are designed to require very little administration.

Yes, Amazon WorkSpaces supports PCoIP Zero Client devices that have the Teradici Tera2 chipset. 

Amazon WorkSpaces preserve the data and state of your applications when stopped. On reconnect, your Amazon WorkSpace will resume with all open documents and running programs intact. On reconnect, your Amazon WorkSpace will retain your files and folders in your last saved location.

By logging into your Amazon WorkSpace from the Amazon WorkSpaces client application, the service will automatically restart your Amazon WorkSpace. When you first attempt to log in, the client application will notify you that your Amazon WorkSpace was previously stopped, and that your new session will start once your WorkSpace has resumed.

If your Amazon WorkSpace has not yet stopped, your connection is almost instantaneous. If you Amazon WorkSpace has already stopped, in most cases it will be available within sixty to ninety seconds.

Amazon WorkSpaces clients support:
• Keyboard, mouse, and touch input (touch input is only supported on tablet clients).  Amazon WorkSpaces do not currently support a 3D mouse.
• Audio output to client device
• Analog and USB headsets
PCoIP Windows WorkSpaces support in-session USB redirection of locally attached YubiKey for Universal 2nd Factor (U2F) authentication from the WorkSpaces Windows client.

Most analog and USB headsets will work for audio conversations through WorkSpaces running Windows. For USB headsets, you should ensure they show up as a playback device locally on your client computer.

Yes. For the best experience, we recommend using a headset for audio calls. However, you may experience an echo when using the built in microphone and speakers with certain communication applications.

Audio-in is supported on the Windows, macOS, Android and iPadOS clients.

Audio-in is enabled for all new WorkSpaces. For WorkSpaces with Windows, enabling the WorkSpaces Audio-in capability requires local logon access inside your WorkSpace. If you have a Group Policy restricting user local logon in your WorkSpace, we will detect it and not apply the Audio-in update to the WorkSpace. You can remove the Group Policy and the Audio-in capability will be enabled after the next reboot.

Yes. We always recommend you refresh your custom images on a regular basis to take advantage of the latest features. WorkSpaces launching from custom images that have not been recently updated may take longer to be available to users. Once a WorkSpace is updated for Audio-In you can use it to create an updated custom image which will include Audio-in support by default.

Yes. The Amazon WorkSpaces desktop client application will automatically scale the in-session display to match the DPI settings of the local device.

Displays Maximum Supported Resolution
1 3840 x 2160 pixels
2 3840 x 2160 pixels
4 1920 x 1200 pixels

Q: Will my bandwidth usage be higher when I use four monitors, or I use 4k Ultra HD resolution?

Yes. The bandwidth requirements for WorkSpaces depends on two factors (a) the number of screens it has to stream to and (b) the amount of pixel changes taking place in each screen.

Q: Will Amazon WorkSpaces remember my monitor settings between sessions?

The fullscreen mode setting will be preserved. If you quit a WorkSpaces session in the fullscreen mode, you will be able to log into the fullscreen mode next time. However, display configurations will not be saved. Every time you initiate a WorkSpaces session, the client application extracts the EDID of uses your local setup configuration and sends that to the WorkSpaces host to deliver an optimal display experience.

Q: What happens to my display settings when I connect to my WorkSpace from a different desktop?

When you connect from a different desktop computer, the display settings of that computer will take precedence to deliver an optimal display experience.

Q: Will the iPad and Android applications support Keyboard/Mouse input?

The Android and iPad clients support both keyboard and mouse input. While we expect most popular keyboard and mouse devices to work correctly, there may be devices that may not be compatible.

Q: What is the end user experience when Multi-Factor Authentication (MFA) is enabled?

Users will be prompted for their Active Directory username and password, followed by their OTP. Once a user passes both Active Directory and RADIUS validation, they will be logged in to their Amazon WorkSpace. To learn more, visit our documentation.

Q: Which languages are supported by Amazon WorkSpaces?

Amazon WorkSpaces bundles that provide the Windows desktop experience currently support Chinese (Simplified) and English (US). You can also download and install language packs for Windows directly from Microsoft. Amazon WorkSpaces client applications currently support English (US), German, Chinese (Simplified), Japanese, French (Canadian), Korean, and Portuguese.

Maintenance and Setup

Open all

Yes. Amazon WorkSpaces enables maintenance windows for both AlwaysOn and AutoStop WorkSpaces by default.

For AlwaysOn (monthly) WorkSpaces, the maintenance schedule is controlled by the OS settings on the WorkSpace. The default maintenance window is a four-hour period from 00h00 – 04h00 (this time window is based on the time zone settings you have set for your Amazon WorkSpaces) each Sunday morning. During this time your WorkSpaces may not be available.

For AutoStop (hourly) WorkSpaces, the default maintenance window is typically from 00h00 to 05h00 everyday starting on the 3rd Monday of the month in the time zone of the WorkSpaces’s Amazon Web Services region. The Maintenance window might take up to two weeks. WorkSpaces can be maintained on any day in the maintenance window. You can set the Maintenance mode for AutoStop WorkSpaces in the WorkSpaces management console. For more information see Manage the WorkSpace Running Mode. The maintenance window for AutoStop WorkSpaces is currently not configurable.

It is highly recommended to keep your WorkSpaces maintained regularly. If you want to run your own WorkSpaces maintenance schedule, it is possible to opt out of the service default maintenance windows for Windows WorkSpaces. 

For AutoStop (hourly) WorkSpaces, you can disable the Maintenance mode on the console. For AlwaysOn Windows WorkSpaces, the maintenance window is controlled by the system settings and can be configured via Automatic Updates GPO settings. Currently, you cannot opt out of the maintenance windows for AlwaysOn Amazon Linux WorkSpaces.

A: By default, your Amazon WorkSpaces are configured to install software updates. Amazon Linux and Ubuntu WorkSpaces will be updated to install the latest security and software patches, and Amazon WorkSpaces with Windows have Windows Updates turned on. Updates to Applications installed via Manage Applications are included as part of your regular Windows Updates. You can customize these settings, or use an alternative patch management approach. Updates are installed at 2am each Sunday. You are responsible to update any 3rd party application that you have installed on your WorkSpaces.

No action is needed on your part. Updates are delivered automatically to your Amazon WorkSpaces during the maintenance window. During the maintenance window, your WorkSpaces may not be available.

No. The Amazon WorkSpaces service requires these updates to be provided to ensure normal operation of your users’ WorkSpaces.

You have full control over the Windows Update configuration in your WorkSpaces, and can use Active Directory Group Policy to configure this to meet your exact requirements.

Amazon WorkSpaces running Amazon Linux are updated via pre-configured Amazon Linux yum repositories hosted in each WorkSpaces region and the updates are automatically installed. Patches and updates requiring a reboot are installed during our weekly maintenance window.

For all other applications, updates can be delivered via the automatic update service for each application if one is available. For applications without an automatic update service, you will need to evaluate the software vendor’s recommended updating approach and follow that if necessary.

The WorkSpaces Management console lets you provision, restart, rebuild, restore, and delete WorkSpaces. To manage the underlying OS for the WorkSpaces, you can use standard Microsoft Active Directory tools such as Group Policy or your choice of Linux orchestration tools to manage the WorkSpaces. In the case when you have integrated WorkSpaces with an existing Active Directory domain, you can manage your WorkSpaces using the same tools and techniques you are using for your existing on-premises desktops. If you have not integrated with an existing Active Directory, you can set up a Directory Administration WorkSpace to perform management tasks. Please see the documentation for more information.

You can also give WorkSpaces users the ability to perform common tasks on their own by enabling self-service management. Once enabled, WorkSpaces users can do things like restart, rebuild, restore, increase volume size, change compute type, and change running mode directly from the WorkSpaces client with no IT or helpdesk intervention.

Yes, you can assign tags to existing Amazon WorkSpaces resources including WorkSpaces, directories registered with WorkSpaces, images, custom bundles, and IP Access Control Groups. You can also assign tags during the creation of new Amazon WorkSpaces and new IP Access Control Groups. You can assign up to 50 tags (key/value pairs) to each Amazon WorkSpaces resource using the Amazon Management Console, the Amazon Command Line Interface, or the Amazon WorkSpaces API. To learn more about assigning tags to your Amazon WorkSpaces resources, follow the steps listed on this web page: Tag WorkSpaces Resources.

A restart is just the same as a regular operating system (OS) reboot. A rebuild will retain the user volume on the WorkSpace but will return the WorkSpace to its original state (any changes made to the system drive will not be retained).

A rebuild will retain the user volume on the WorkSpace but will return the WorkSpace to its original state (any changes made to the system drive will not be retained). A restore will retain both the root and user volumes on the WorkSpace but will return the WorkSpace to the last healthy state as detected by the service.

To remove a WorkSpace you no longer require, you can “delete” the Workspace. This will remove the underlying instance supporting the WorkSpace and the WorkSpace will no longer exist. Deleting a WorkSpace will also remove any data stored on the volumes attached to the WorkSpace, so please confirm you have saved any data you must keep prior to deleting a WorkSpace.

No. You can currently only provide one WorkSpace for each user.

You can launch as many Amazon WorkSpaces as you need. Amazon WorkSpaces sets default limits, but you can request an increase in these limits here. To see the default limits for Amazon WorkSpaces, please visit our documentation.

The bandwidth needed to use your WorkSpace depends on what you're doing on your WorkSpace. For general office productivity use, we recommend that a bandwidth download speed of between 300Kbps up and 1Mbps. For graphics intensive work we recommend bandwidth download speeds of 3Mbps.

While the remoting protocol has a maximum round trip latency recommendation of 250 ms, the best user experience will be achieved at less than 100 ms.

Yes. For WorkSpaces running Windows, we recommend selecting the "High Performance" power plan in Windows. For WorkSpaces running Linux, you should select a power plan that optimizes for performance.

If you wish to implement Quality of Service on your network for WorkSpaces traffic, you should prioritize the WorkSpaces interactive video stream which is comprised of real time traffic on UDP port 4172. If possible, this traffic should be prioritized just after VoIP to provide the best user experience.

Zero Clients should be updated to firmware version 6.0.0 (or newer). Please consult the Amazon WorkSpaces documentation for a step by step guide on how to properly setup the PCoIP Connection Manager, and for help on how to find and install the necessary firmware required for your Zero Clients.

Billing and Pricing

Open all

You can pay for your Amazon WorkSpaces either by the hour, or by the month. You only pay for the WorkSpaces you launch, and there are no upfront fees and no term commitments. The fees for using Amazon WorkSpaces include use of both the infrastructure (compute, storage, and bandwidth for streaming the desktop experience to the user) and the software applications listed in the bundle.

Please see our pricing page for the latest information.

Yes, you can pay for your Amazon WorkSpaces by the hour. Hourly pricing is available for all WorkSpaces bundles.

Hourly pricing has two components: an hourly usage fee, and a low monthly fee for fixed infrastructure costs. Hourly usage fees are incurred only while your Amazon WorkSpaces are actively being used, or undergoing routine maintenance. When your Amazon WorkSpaces are not being used, they will automatically stop after a specified period of inactivity, and hourly metering is suspended. When your Amazon WorkSpaces resume, hourly charges begin to accrue again.

To launch an Amazon WorkSpace to be billed hourly, simply select a user, choose an Amazon WorkSpaces bundle (a configuration of compute resources and storage space), and specify the AutoStop running mode. When your Amazon WorkSpace is created, it will be billed hourly.

With monthly billing, you pay a fixed monthly fee for unlimited usage and instant access to a running Amazon WorkSpace at all times. Hourly pricing allows you to pay for your Amazon WorkSpaces by the hour and save money on your Amazon Web Services bill when your users only need part-time access to their Amazon WorkSpaces. When your Amazon WorkSpaces being billed hourly are not being used, they automatically stop after a specified period of inactivity, and hourly usage metering is suspended.

To make hourly billing possible, Amazon WorkSpaces now operates in two running modes – AutoStop and AlwaysOn. The AutoStop running mode allows you to pay for your Amazon WorkSpaces by the hour. The AlwaysOn running mode is used when paying a fixed monthly fee for unlimited usage of your Amazon WorkSpaces. You can easily choose between monthly and hourly billing by selecting the running mode when you launch Amazon WorkSpaces through the Amazon Management Console, the Amazon WorkSpaces APIs, or the Amazon WorkSpaces Command Line Interface. You can also switch between running modes for your Amazon WorkSpaces at any time.

Hourly usage fees start accruing as soon as your Amazon WorkSpace is running. Your Amazon WorkSpace may resume in response to a login request from a user, or to perform routine maintenance.

Hourly usage charges are suspended when your Amazon WorkSpaces stop. AutoStop automatically stops your WorkSpaces a specified period of time after users disconnect, or when scheduled maintenance is completed. The specified time period is configurable and is set to 60 minutes by default. Note that partial hours are billed as a full hour, and the monthly portion of hourly pricing does not suspend when your Amazon WorkSpaces stop.

You can manually stop Amazon WorkSpaces from the Amazon Management Console, or by using the Amazon WorkSpaces APIs. To stop the monthly fee associated with your hourly Amazon WorkSpaces, you need to remove the Amazon WorkSpaces from your account (note: this also deletes all data stored in those Amazon WorkSpaces).

Yes, you can switch from hourly to monthly billing for your Amazon WorkSpaces at any time by switching the running mode to AlwaysOn in the Amazon Web Services Management Console, or through the Amazon WorkSpaces APIs. When you switch, billing immediately changes from hourly to monthly, and you are charged a prorated amount at the monthly rate for the remainder of the month, along with the monthly and hourly usage fees already billed for the month. Your Amazon WorkSpaces will continue to be charged monthly unless you switch the running mode back to AutoStop.

You can switch from monthly to hourly billing by setting the running mode to AutoStop in the Amazon Web Services Management Console or through the Amazon WorkSpaces APIs. Switching from monthly to hourly billing will take effect the following month as you will have already paid for your Amazon WorkSpaces for that month. Your Amazon WorkSpaces will continue to be charged hourly unless you switch the running mode back to AlwaysOn. Your Amazon WorkSpaces will continue to be charged hourly unless you switch the running mode back to AlwaysOn. Please note that billing renewals happen at 00:00 Pacific Time on the first of each month.

WorkSpaces users can also switch between monthly and hourly billing directly from the WorkSpaces client if this self-service management capability is enabled by their WorkSpaces administrator.

If you’re paying for your Amazon WorkSpaces monthly, your Amazon WorkSpaces are charged for the full month’s usage. If you’re paying hourly (AutoStop running mode), you are charged for the hours during which your Amazon WorkSpaces are running or undergoing maintenance, plus a monthly fee for fixed infrastructure costs. In both cases, the monthly fee is prorated in the first month only.

Yes, you will be charged a small monthly fee for the Amazon WorkSpaces bundle you selected. If you’ve chosen an Amazon WorkSpaces Plus bundle, you will be charged for the software subscription as well. You can find the monthly fees for all Amazon WorkSpaces on the pricing page.

Plus bundles are always charged monthly, even if you’re paying for your Amazon WorkSpaces by the hour. If you selected a Plus bundle when you launched your WorkSpaces, you will incur the listed fee for the Plus software bundle even if you do not use those Amazon WorkSpaces in a particular month.

Yes, you will be able to monitor the total number of hours your Amazon WorkSpaces have been running in a given period of time through the Amazon CloudWatch “UserConnected” metric.

Amazon WorkSpaces pricing includes network traffic between the user’s client and their WorkSpace. Web traffic from WorkSpaces (for example, accessing the public Internet, or downloading files) will be charged separately based on current Amazon EC2 data transfer rates listed here.

There is no additional charge for Amazon WorkSpaces created from custom images. You will be charged the same as the underlying bundles on which the customized images are based.

Yes. You can launch Amazon WorkSpaces billed hourly from images that you create and upload. There is no additional charge for Amazon WorkSpaces launched from custom images. You will be charged the same as the underlying bundles on which the customized images are based.

The Amazon WorkSpaces client applications are provided at no additional cost, and you can install the clients on as many devices as you need to. You can access these here.

Yes. By setting tags to appear on your monthly Cost Allocation Report, your Amazon Web Services monthly bill will also include those tags. You can then easily track costs according to your needs. To do this, first assign tags to your Amazon WorkSpaces by following the steps listed on this web page: Tagging WorkSpaces. Next, select the tag keys to include in your cost allocation report by following the steps listed on this web page: Setting Up Your Monthly Cost Allocation Report.

There are no additional costs when using tags with your Amazon WorkSpaces.

You will need to provide Amazon Web Services your institution's full legal name, principle office address, and public website URL. Amazon Web Services will use this information to qualify you for reduced user fees for qualified educational institutions with your WorkSpaces. Please note: The use of Microsoft software is subject to Microsoft’s terms. You are responsible for complying with Microsoft licensing. If you have questions about your licensing or rights to Microsoft software, please consult your legal team, Microsoft, or your Microsoft reseller. You agree that we may provide the information to Microsoft in order to apply educational pricing to your Amazon WorkSpaces usage.

No, your user fees are specific to Amazon WorkSpaces, and do not affect any other Amazon Web Services cloud services or licenses you have.

Free Tier

Open all

A: The Amazon WorkSpaces Free Tier allows you to provision two Standard bundle WorkSpaces with 80 GB Root and 50 GB User volumes. The Standard bundle WorkSpace offers a cloud desktop with 2 vCPUs, 4 GB of memory, 80 GB Root and 50 GB User volume of SSD-based storage, and you can choose between Amazon Linux WorkSpaces, Amazon WorkSpaces with Windows 10 desktop experiences powered by Windows Server. As with all WorkSpaces, your WorkSpace comes with the pre-installed applications, and access to Amazon WorkDocs with 50 GB included storage. Limited-time promotion offers might be offered via the Free Tier, please refer to the WorkSpaces pricing page for the latest information.

Connectivity

Open all

Yes, you can configure a WorkSpaces Client app to use an HTTPS proxy. Please see our documentation for more information.

Yes. The first time you connect to the WorkSpaces Management Console, you can choose an easy ‘getting started’ link that will create a new VPC and two associated subnets for you as well as an Internet Gateway and a directory to contain your users. If you choose to access the console directly, you can choose which of your VPCs your WorkSpaces will connect to.

Yes. You can use AD Connector or Amazon Web Services Microsoft AD to integrate with your existing on-premises Active Directory.

Yes. You have full control over how your Amazon WorkSpaces connect to the Internet based on regular VPC configuration. Depending on what your requirements are you can either deploy a NAT instance for Internet access, assign an Elastic IP Address (EIP) to the Elastic Network Interface (ENI) associated with the WorkSpace, or your WorkSpaces can access the Internet by utilizing the connection back to your on-premises network.

A: Yes. You can use IPv6 addresses for Value, Standard, Performance, Power, and PowerPro bundles. At this time, IPv6 addresses are not supported in Graphics.g4dn, or GraphicsPro.g4dn bundles.

Yes. Your WorkSpaces can connect to applications such as a fileserver running in Amazon EC2 (both “Classic” and VPC networking environments). All you need to do is ensure appropriate route table entries, security groups and network ACLs are configured so that the WorkSpaces can reach the EC2 resources you would like them to be able to connect to.

To use your certificates to manage which client devices can access Amazon WorkSpaces, you need to distribute your client certificates using your preferred solution such as Microsoft System Center Configuration Manager (SCCM), or a Mobile-Device Management (MDM) software solution to the devices you want to trust. Your root certificates are imported into the WorkSpaces management console. For more information, please see Restrict WorkSpaces Access to Trusted Devices.

To enable MFA on WorkSpaces, you will need to configure AD Connector, and have an on-premises RADIUS server(s). Your on-premises network must allow inbound traffic over the default RADIUS server port (1812) from the AD Connector server(s). Additionally, you must ensure that usernames match between Active Directory and your RADIUS server. To learn more, visit our documentation.

Directories

Open all

Each user you provision a WorkSpace for needs to exist in a directory, but you do not have to provision a directory yourself. You can either have the WorkSpaces service create and manage a directory for you and have users in that directory created when you provision a WorkSpace. Alternatively, you can integrate WorkSpaces with an existing, on-premises Active Directory so that users can continue to use their existing credentials meaning that they can get seamless applications to existing applications.

Yes. Please see our documentation for more details.

Yes. You can use AD Connector or Amazon Web Services Microsoft AD to integrate with your existing on-premises Active Directory.

There are two ways you can integrate Amazon WorkSpaces with your on-premises Microsoft Active Directory (AD): you can set up an interforest trust relationship with your Amazon Web Services Microsoft AD domain controller, or you can use AD Connector to proxy AD authentication requests.

To configure an interforest trust relationship between your on-premises Microsoft AD and your Amazon Web Services Microsoft AD please see the documentation here. To configure AD Connector, please see the documentation here.

Once a trust is established, you can select the domain where your user accounts reside directly in the Amazon WorkSpaces console, and proceed to provisioning WorkSpaces for your users. Please note that usernames across domains need to be unique per instance of Amazon Web Services Microsoft AD.