View a markdown version of this page

IP access control groups for WorkSpaces Personal - Amazon WorkSpaces
Create an IP access control groupAdd or remove rules in an IP access control groupAssociate or disassociate an IP access control group with a directoryCopy an IP access control groupDelete an IP access control group
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

IP access control groups for WorkSpaces Personal

Amazon WorkSpaces allows you to control which IP addresses your WorkSpaces can be accessed from. By using IP address-based control groups, you can define and manage groups of trusted IP addresses, and only allow users to access their WorkSpaces when they're connected to a trusted network.

An IP access control group acts as a virtual firewall that controls the IP addresses from which users are allowed to access their WorkSpaces. To specify the CIDR address ranges, add rules to your IP access control group, and then associate the group with your directory. You can add up to 30 rules per IP access control group and can associate each IP access control group with one or more directories. You can create up to 140 IP access control groups per Region per Amazon account. However, you can only associate up to 35 IP access control groups with a single directory.

A default IP access control group is associated with each directory. This default group includes a default rule that allows users to access their WorkSpaces from anywhere. You cannot modify the default IP access control group for your directory. If you don't associate an IP access control group with your directory, the default group is used. If you associate an IP access control group with a directory, the default IP access control group is disassociated.

To specify the public IP addresses and ranges of IP addresses for your trusted networks, add rules to your IP access control groups. If your users access their WorkSpaces through a NAT gateway or VPN, you must create rules that allow traffic from the public IP addresses for the NAT gateway or VPN.

Note

  • IP access control groups do not allow the use of dynamic IP addresses for NATs. If you're using a NAT, configure it to use a static IP address instead of a dynamic IP address. Make sure the NAT routes all the UDP traffic through the same static IP address for the duration of the WorkSpaces session.

  • IP access control groups control the IP addresses from which users can connect their streaming sessions to WorkSpaces. Users can still execute functionalities, such as restart, rebuild, shutdown, from any IP address using Amazon WorkSpaces public APIs.

  • Do not associate IP access control groups with a directory when you configure a VPC endpoint for streaming for that directory.

  • When you change an IP access control, active sessions are not immediately interrupted; changes will be applied for new sessions only.

You can use this feature with Web Access, PCoIP zero clients, and the client applications for macOS, iPad, Windows, and Android.

Create an IP access control group

You can create an IP access control group as follows. Each IP access control group can contain up to 30 rules.

To create an IP access control group

  1. Open the WorkSpaces console at https://console.amazonaws.cn/workspaces/v2/home.

  2. In the navigation pane, choose IP Access Controls.

  3. Choose Create IP access control group.

  4. In the Create IP access group dialog box, enter a name and description for the group.

  5. Enter the first rule. For Source, enter the IP address or IP address range. For Description, optionally enter a description. To add more rules, choose Add rule and enter each additional rule.

  6. Choose Create.

Add or remove rules in an IP access control group

You can add or remove rules in an existing IP access control group. Removing a rule does not disconnect users who are already connected. However, after a user disconnects, they can reconnect only from an IP address that an existing rule allows.

To add or remove rules in an IP access control group

  1. Open the WorkSpaces console at https://console.amazonaws.cn/workspaces/v2/home.

  2. In the navigation pane, choose IP Access Controls.

  3. Choose the ID of the group that you want to edit.

  4. In the Rules section, choose Edit.

  5. On the Edit rules page, do one or both of the following:

    1. To remove a rule, choose Remove for that rule.

    2. To add a rule, choose Add rule. For Source, enter the IP address or IP address range. For Description, optionally enter a description.

  6. Choose Save.

Associate or disassociate an IP access control group with a directory

You can associate an IP access control group with a directory to ensure that WorkSpaces are accessed only from trusted networks. You can also disassociate a group from a directory, for example when you move a group from one directory to another.

If you associate an IP access control group that has no rules with a directory, this blocks all access to all WorkSpaces.

To associate an IP access control group with a directory

  1. Open the WorkSpaces console at https://console.amazonaws.cn/workspaces/v2/home.

  2. In the navigation pane, choose Directories.

  3. Choose the directory ID.

  4. Scroll to the IP access control groups section, and then choose Edit.

  5. Select one or more IP access control groups to associate with the directory.

  6. Choose Associate.

To disassociate an IP access control group from a directory

  1. Open the WorkSpaces console at https://console.amazonaws.cn/workspaces/v2/home.

  2. In the navigation pane, choose Directories.

  3. Choose the directory ID.

  4. Scroll to the IP access control groups section, and then choose Edit.

  5. Clear the check box for each IP access control group that you want to disassociate.

  6. Choose Disassociate.

Copy an IP access control group

You can use an existing IP access control group as a base for creating a new IP access control group.

To create an IP access control group from an existing one

  1. Open the WorkSpaces console at https://console.amazonaws.cn/workspaces/v2/home.

  2. In the navigation pane, choose IP Access Controls.

  3. Select the group and choose Actions, Copy to new.

  4. In the Copy to new dialog box, enter a name and description for the new group and choose Copy.

  5. (Optional) To modify the rules copied from the original group, see Add or remove rules in an IP access control group.

Delete an IP access control group

Before you can delete an IP access control group, you must disassociate it from any directories. For more information, see Associate or disassociate an IP access control group with a directory.

To delete an IP access control group

  1. Open the WorkSpaces console at https://console.amazonaws.cn/workspaces/v2/home.

  2. Disassociate the IP access control group from any directories that it is associated with.

  3. In the navigation pane, choose IP Access Controls.

  4. Select the group and choose Actions, Delete.

  5. In the confirmation dialog box, enter delete to confirm, and then choose Delete.