WorkSpaces Console operations and required permissions for actions

Amazon WorkSpaces Console operations permissions reference

Some Amazon WorkSpaces APIs can only be called through the Amazon Management Console. They are not public APIs, in the sense they cannot be called programmatically, and they are not provided by any SDK. These API operations include:

workspaces:DirectoryAccessManagement
workspaces:CreateRootClientCertificate
workspaces:UpdateRootClientCertificate
workspaces:DeleteRootClientCertificate
workspaces:DescribeConsent
workspaces:UpdateConsent

WorkSpaces Console operations and required permissions for actions

The console uses additional API actions for its features, so the permissions for the WorkSpaces public APIs may not be sufficient. For example, a user that has permissions to use the CreateWorkspaces API via CLI/SDK may encounter errors when trying to create a WorkSpace on the console, because they are missing certain permissions to select or create Users. This table lists the features that are only available on the WorkSpaces Console and the required additional permissions that enable users to work with these specific parts of the console.

The Example policies section provides the list of permissions to perform all WorkSpaces tasks for Personal, Pools and BYOL WorkSpaces.

Alternatively, you could also use granular permissions to apply least-privilege permissions to perform a task.

This table lists the WorkSpaces Console features that rely on the APIs that are not provided by the SDK and the required permissions that enable users to work with these specific parts of the console. These permissions should be added in addition to other actions required for APIs provided by the SDK.

WorkSpaces Console operations	Required permissions
WorkSpaces Personal Quick Setup	workspaces:DirectoryAccessManagement ds:* ec2:CreateVpc ec2:CreateSubnet ec2:CreateNetworkInterface ec2:CreateInternetGateway ec2:CreateRouteTable ec2:CreateRoute ec2:CreateTags ec2:CreateSecurityGroup ec2:DescribeInternetGateways ec2:DescribeSecurityGroups ec2:DescribeRouteTables ec2:DescribeVpcs ec2:DescribeSubnets ec2:DescribeNetworkInterfaces ec2:DescribeAvailabilityZones ec2:AttachInternetGateway ec2:AssociateRouteTable ec2:AuthorizeSecurityGroupIngress ec2:AuthorizeSecurityGroupEgress iam:CreateRole iam:GetRole iam:PutRolePolicy workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:CreateWorkspaces workspaces:DescribeWorkspaces workspaces:RegisterWorkspaceDirectory workspaces:DescribeWorkspaceBundles workspaces:DescribeWorkspaces
Restrict access to Trusted Devices for WorkSpaces Personal	workspaces:CreateRootClientCertificate workspaces:UpdateRootClientCertificate workspaces:DeleteRootClientCertificate ds:DescribeDirectories ec2:DescribeSubnets ec2:DescribeSecurityGroups workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DescribeTags workspaces:DescribeClientProperties workspaces:DescribeConnectClientAddins workspaces:DirectoryAccessManagement
Creating a WorkSpace in WorkSpaces Personal on the Console – To create/search/describe Directory Service directory users	workspaces:DirectoryAccessManagement workspaces:DescribeAccount workspaces:CreateWorkspaces workspaces:DescribeWorkspaces workspaces:DescribeWorkspaceDirectories workspaces:DescribeWorkspaceBundles workspaces:DescribeTags workspaces:CreateTags workspaces:DescribeClientProperties kms:ListKeys kms:ListAliases kms:DescribeKey ds:DescribeTrusts ds:DescribeDirectories ec2:DescribeSubnets ec2:DescribeSecurityGroups
Manage users in WorkSpaces Personal – To edit users and send user invitation email	workspaces:DirectoryAccessManagement workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DescribeWorkspaces workspaces:DescribeTags workspaces:DescribeWorkspaceBundles workspaces:DescribeWorkspacesConnectionStatus workspaces:DescribeWorkspaceAssociations workspaces:DescribeWorkspaceSnapshots workspaces:DescribeWorkspaceImages workspaces:DescribeConnectionAliases
Update the AD Connector account (AD Connector) for WorkSpaces Personal	workspaces:DirectoryAccessManagement ds:DescribeDirectories ds:UpdateDirectory ec2:DescribeSubnets ec2:DescribeSecurityGroups workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DescribeTags workspaces:DescribeClientProperties workspaces:DescribeConnectClientAddins
Select an organizational unit for WorkSpaces Personal	workspaces:DirectoryAccessManagement ds:DescribeDirectories ec2:DescribeSubnets ec2:DescribeSecurityGroups workspaces:DescribeAccount workspaces:DescribeWorkspaceDirectories workspaces:DescribeTags workspaces:DescribeClientProperties workspaces:DescribeConnectClientAddins workspaces:ModifyWorkspaceCreationProperties
Enable your account for BYOL – To confirm understanding of the requirements to use BYOL WorkSpaces	workspaces:DescribeConsent workspaces:UpdateConsent workspaces:DescribeAccount workspaces:ListAccountLinks workspaces:DescribeWorkspaceBundles workspaces:DescribeWorkspaceImages workspaces:DescribeWorkspaceDirectories

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Access to WorkSpaces and scripts on streaming instances

Compliance validation