Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

WorkSpaces - access via corporate VPN only

0

For a customer I want to use WorkSpaces as fully functional virtual desktop. Customer's corporate network will be connected to private network with site-to-site VPN, or in specific use-cases client VPN for specific users. According to our requirements, all the traffic between any system/user in corporate network, and any service in private network in AWS needs to be enclosed in VPN connection, so split tunneling isn't an option. According to what I've found in documentation, and previous questions here, the possibility to reach public endpoints is a requirement to use WorkSpaces. Is it possible to enclose whole WorkSpaces streaming traffic in private network without any part of it traversing public network?

Topics
End User ComputingSecurity, Identity, & ComplianceNetworking & Content Delivery
Tags
Amazon WorkSpacesSecurity, Identity, & ComplianceNetworking & Content Delivery
Language
English

asked 2 years ago665 views

2 Answers
1
Accepted Answer

As Gary mention, you can explore an internal proxy server that connects to WorkSpaces across AWS network.

Depending on your use case, you can consider Amazon AppStream which supports streaming through VPC endpoints. While it is not a persistent desktop environment like WorkSpaces, you can enable application and home directory persistence.

AWS
EXPERT

answered 2 years ago

EXPERT

reviewed 2 years ago

0

heres a similar question on re:Post I answered 3 months ago

https://repost.aws/questions/QUJrRjN05oRaydKYEXhfcF-Q/workspaces-ip-restriction-and-access-via-corporate-vpn

Yes, you need access to the public Gateway for Workspaces, but you could proxy it via a internal Proxy server which will need access to the internet to connect to the end point

EXPERT

answered 2 years ago

  • User-4432964
    2 years ago

    Thanks for your answer. I've seen it already, both options mentioned there are not entirely fitting my requirements, split tunnelling explicitly leaves part of traffic in public connection, proxy server would still require the last bit of the whole path to reach public internet. I was hoping for a way (possibly not documented yet) to entirely enclose it in private network, in a way similar to what PrivateLink offers for API here: https://docs.aws.amazon.com/workspaces/latest/adminguide/infrastructure-security.html

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content