October 19th 2015, Amazon WorkSpaces: Advanced Topics and Deep Dive, Justin Bradley Das AWS Pop-up Loft in Berlin ist nur für kurze Zeit geöffnet. Vom 15.10. bis 13.11.2015 haben Sie die einmalige Gelegenheit Teil von etwas Besonderem zu sein. Werden Sie jetzt kostenlos Loft Member und erhalten Sie exklusiven Zugang zu den attraktiven Loft-Angeboten. http://aws.amazon.com/de/start-ups/loft/de-loft/

1. Amazon WorkSpaces: Advanced Topics and Deep Dive
Justin Bradley,
AWS Solutions Architect

2. Agenda
1. Amazon WorkSpaces Overview
2. Amazon WorkSpaces Bundles
3. Amazon WorkSpaces Application Manager &
Marketplace for Desktop Apps
4. Amazon Directory Service- Active Directory
Integration
5. Network Considerations (Amazon Virtual Private
Cloud)
6. Amazon WorkSpaces Communiction Flows

3. The Work* Services
WorkDocs
Secure enterprise
document collaboration
WorkSpaces
Virtual desktops
Secure access from anywhere
Monthly pricing
Central sync, document feedback
Secure access from anywhere
S3
WorkSpaces Application
Manager (WAM)
Virtual applications
Centralized application deployment
Monthly subscription options
WorkMail
Secure email and
calendaring
Strong security controls
Existing desktop, mobile support
Directory Service
Simple AD, AD Connector

4. WorkSpaces: Fully Managed
• Launch the number of WorkSpaces needed
• All heavy lifting taken care of by AWS
• Users receive email to install clients and connect
WorkSpaces

5. Amazon WorkSpaces Devices
• iPad
• Kindle Fire HDX (Keyboard & Mouse)
• Android Tablet
• Microsoft Windows
• Mac
• Zero clients
• Cromebook

6. Keep Data Secure and Available
• No data stored on end-user device
• Only Pixels delivered to users (PCoIP)
• User volume backed by Amazon S3
• Multi-factor authentication (MFA)
• Encrypted Storage Volumes Using KMS

7. Keep Data Secure and Available
• Securely backup and sync users data
• Install on the WorkSpace and a PC or Mac
• Data is backed up to Amazon S3
• Users can access their data when they need it
WorkDocs Sync Client

8. WorkSpaces: Bundles
• WorkSpaces are provisioned from bundles
• 3 WorkSpaces hardware configurations
• 3 WorkSpaces images – Default, Office 2010 or
Office 2013
Instance
Type
Image (AMI)
Bundle
Value (t2.small)
Standard (t2.medium)
Performance (m3.large)
Default
Custom
No Office
Office 2010 Professional (Plus)
Office 2013 Professional (Plus)

9. WorkSpaces: Choose Software and Hardware
WorkSpaces Bundle Hardware Resources Applications
Value 1 vCPU, 2 GiB Memory (t2.small), 10 GB User Storage Utilities (Adobe Reader, Internet Explorer 9,
Firefox, 7-Zip, Adobe Flash)
Value Plus 1 vCPU, 2 GiB Memory (t2.small), 10 GB User Storage Microsoft Office Professional 2010, Trend
Micro Worry-Free Business Security, Utilities
(Adobe Reader, Internet Explorer 9, Firefox, 7-
Zip, Adobe Flash)
Standard 2 vCPU, 4 GiB Memory (t2.medium), 50 GB User Storage Utilities (Adobe Reader, Internet Explorer 9,
Firefox, 7-Zip, Adobe Flash)
Standard Plus 2 vCPU, 4 GiB Memory (t2.medium), 50 GB User Storage Microsoft Office Professional 2010, Trend
Micro Worry-Free Business Security, Utilities
(Adobe Reader, Internet Explorer 9, Firefox, 7-
Zip, Adobe Flash)
Performance 2 vCPU, 7.5 GiB Memory (m3.large), 100 GB User Storage Utilities (Adobe Reader, Internet Explorer 9,
Firefox, 7-Zip, Adobe Flash)
Performance Plus 2 vCPU, 7.5 GiB Memory (m3.large), 100 GB User Storage Microsoft Office Professional 2010, Trend
Micro Worry-Free Business Security, Utilities
(Adobe Reader, Internet Explorer 9, Firefox, 7-
Zip, Adobe Flash)

10. WorkSpaces: Install your own software
• No technical restrictions on software installation
• Manage WorkSpaces like any other desktop
• Use the tools you already use to distribute
• WorkSpaces Application Manager (WAM)
• WorkSpaces Marketplace for Desktop Apps
• Create your own bundles (Custom)

11. WAM: Managing Applications for your Users
Amazon WorkSpaces
Application Manager
(Amazon WAM)
Deploy and Manage Applications
Package your own applications
Upload applications where you own
the license
Subscribe from the AWS Marketplace
for Desktop Apps

12. Amazon WAM Benefits
WorkSpaces
Amazon
WAM
Catalog Deploy
Apps
for Desktop Apps
Applications where you already
own the license
Line of business
applications
Curate a wide range of applications

13. WorkSpaces: Marketplace for Desktop Apps

14. DEMO: WAM & Marketplace for Desktop Apps

15. WorkSpaces: AD Integration
• Users: Get to use existing Enterprise Credentials
• IT: WorkSpaces control like regular desktops
– Store in the OU that makes sense to you

16. Simple AD
Alex Hardy
(ahardy)
Emily McLane
(emclane)
Tim Nuberg
(tnuberg)
Simple AD
AD
Connector
Alex Hardy
(ahardy)
Emily McLane
(emclane)
Tim Nuberg
(tnuberg)
AD
AD Connector
• 1 user = 1 directory username = 1 WorkSpaces desktop
– Example: Alex Hardy -> ahardy -> desktop (ahardy) (Directory Instance 1)
– Users cannot have 2 or more desktops per username, per directory instance
WorkSpaces backed by..

17. • Ensure existing AD is reachable (via VPC)
• Create AD Connector + Directory Account
• Launch WorkSpaces users in connected domain
• This could be on-premises or in EC2
WorkSpaces: Corporate Directory Integration Steps
Customer
Corp Network
10.31.0.0/16 VPC 172.16.0.0/16
AD
Connector
ENI
ENI
VPN
Connection
Active
Directory WorkSpaces
(Eth1)

18. Availability Zone B
Private subnet
DC4
Corporate Network
London
DC1
VPN / Direct
Connect
Paris
DC2
Cost 50
Availability Zone A
Private subnet
DC3
Cost 10
company.local
company.local
One single identity, data center extension mode
(Rely on Active Directory Sites, Read-Only or not)
WorkSpaces: Extend customer domain

19. WorkSpaces: Network Considerations (VPC)
• directory : a Directory Service instance
• 1 directory spans exactly two subnets
• 1 directory = 2 EC2 instances (1 per subnet)
• You can have multiple directories in 1 VPC
• Each directory has its own registration code
• Zero clients: each regcode needs its own url
Subnet A (AZ 1) Subnet B (AZ 2)
regcode
(example: WSpdx+A1B2C3)
zero client url
(example: https://url1.company.com)
Visualization of a Directory Instance
laptops, desktops, tablets
zero clients

20. WorkSpaces: Network Considerations (VPC)
• VPC Subnet Size
– AWS Fact: Largest VPC size: /16 (65K addresses)
• WorkSpaces reside in subnets as defined for Directory Connector
• Each Subnet – 6 IP’s
• Regional proximity to users
• Tie into global network via Direct Connect
• Use Existing IP space
• Restrict corporate network access when necessary

21. Auth/Session
Gateways
Public
AWS
Endpoint
WorkSpaces
(network entry point)
Customer VPC
EC2
WorkSpaces: Communication Flow
Active
Directory
corp
servers
Direct Connect
or VPN
Customer
Corp Net
Users
Customer
Internet
AD
Connector
Public
AWS
Endpoint
Streaming
Gateway
7
1
2
3
45
6a
6b
8
9
WorkSpaces
auth/session (SSL)
WorkSpaces
streaming (PCoIP)
all other traffic
NETWORK TRAFFIC LEGEND
AWS-managed
Auth: Directory Service
Session: WorkSpaces
Stream: WorkSpaces
Customer-managed
firewall needs to allow
for egress traffic
(Appendix A)
firewall needs to allow
for ingress traffic
(Appendix B)
WorkSpaces
auth (LDAP/RADIUS)
MFA (RADIUS)
(Optional)
auth-only

22. Questions?

23. aws.amazon.com/de/activate
Everything and Anything Startups
Need to Get Started on AWS