Amazon managed policies for WorkSpaces
Using Amazon managed policies makes adding permissions to users, groups, and roles easier than writing policies yourself.
It takes time and expertise to create
IAM customer managed policies
Amazon services maintain and update Amazon managed policies. You can't change the permissions in Amazon managed policies. Services may occasionally add additional permissions to an Amazon managed policy to support new features. This type of update affects all identities (users, groups, and roles) where the policy is attached. Services are most likely to update an Amazon managed policy when a new feature is launched or when new operations become available. Services don't remove permissions from an Amazon managed policy, so policy updates won't break your existing permissions.
Additionally, Amazon supports managed policies for job functions that span multiple services. For example, the ReadOnlyAccess
Amazon managed policy provides read-only access to all Amazon services and resources. When a service launches a new feature, Amazon adds read-only permissions
for new operations and resources. For a list and descriptions of job function policies, see
Amazon managed policies for job functions
Amazon managed policy: AmazonWorkSpacesAdmin
This policy provides access to Amazon WorkSpaces administrative actions. It provides the following permissions:
workspaces
- Allows access to perform administrative actions on WorkSpaces resources.kms
- Allows access to list and describe KMS keys, as well as list aliases.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "workspaces:CreateTags", "workspaces:CreateWorkspaces", "workspaces:CreateWorkspaceImage", "workspaces:DeleteTags", "workspaces:DescribeTags", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspacesConnectionStatus", "workspaces:ModifyCertificateBasedAuthProperties", "workspaces:ModifyWorkspaceProperties", "workspaces:ModifySamlProperties", "workspaces:RebootWorkspaces", "workspaces:RebuildWorkspaces", "workspaces:RestoreWorkspaces", "workspaces:StartWorkspaces", "workspaces:StopWorkspaces", "workspaces:TerminateWorkspaces" ], "Resource": "*" } ] }
Amazon managed policy: AmazonWorkspacesPCAAccess
This managed policy provides access to Amazon Certificate Manager Private Certificate Authority (Private CA) resources in your Amazon account for certificate-based authentication. It is included in the AmazonWorkSpacesPCAAccess role, and it provides the following permissions:
-
acm-pca
- Allows access to Amazon Private CA to manage certificate-based authentication.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate", "acm-pca:GetCertificate", "acm-pca:DescribeCertificateAuthority" ], "Resource": "arn:*:acm-pca:*:*:*", "Condition": { "StringLike": { "aws:ResourceTag/euc-private-ca": "*" } } } ] }
Amazon managed policy: AmazonWorkSpacesSelfServiceAccess
This policy provides access to the Amazon WorkSpaces service to perform WorkSpaces self-service actions initiated by a user.
It is included in the workspaces_DefaultRole
role, and it provides the following permissions:
-
workspaces
- Allows access to self-service WorkSpaces management capabilities for users.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "workspaces:RebootWorkspaces", "workspaces:RebuildWorkspaces", "workspaces:ModifyWorkspaceProperties" ], "Effect": "Allow", "Resource": "*" } ] }
Amazon managed policy: AmazonWorkSpacesServiceAccess
This policy provides customer account access to the Amazon WorkSpaces service for launching a WorkSpace.
It is included in the workspaces_DefaultRole
role, and it provides the following permissions:
-
ec2
- Allows access to manage Amazon EC2 resources associated with a WorkSpace, such as network interfaces.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces" ], "Effect": "Allow", "Resource": "*" } ] }
WorkSpaces updates to Amazon managed policies
View details about updates to Amazon managed policies for WorkSpaces since this service began tracking these changes.
Change | Description | Date |
---|---|---|
Amazon managed policy: AmazonWorkSpacesAdmin - Updated policy | WorkSpaces added the workspaces:RestoreWorkspace action to the Amazon WorkSpacesAdmin managed policy,
granting admins access to restore WorkSpaces.
|
June 25, 2023 |
Amazon managed policy: AmazonWorkspacesPCAAccess - Added new policy | WorkSpaces added a new managed policy to grant acm-pca permission to manage
Amazon Private CA to manage certificate-based authentication. |
November 18, 2022 |
WorkSpaces started tracking changes | WorkSpaces started tracking changes for its WorkSpaces managed policies. | March 1, 2021 |