Secure access to AWS WorkSpaces

AWS Client VPN / a DX do not add any security improvement. WorkSpaces gateways are public, so any traffic that traverses a private connection would need to egress their network to connect to our public edge. Also, streaming traffic, for WorkSpaces, is AES 256 bit encrypted. I would suggest you look at some of the functions to limit connectivity to WorkSpaces. Things like Certificate based auth and IP allowlisting can allow them to limit the specific devices that can access their WorkSpaces as well as where they can connect from.