Amazon WorkSpaces and AWS Directory Services

Based on your requirements, configuring Amazon WorkSpaces without AWS Managed AD or AD Connector presents some challenges, but there are potential solutions to consider:

1. Directory Service: While you want to avoid AWS Managed AD, you will still need some form of directory service for WorkSpaces. Simple AD could be a lightweight alternative to AWS Managed Microsoft AD. It's compatible with WorkSpaces and doesn't require integration with an on-premises AD. However, it's important to note that Simple AD has limitations compared to AWS Managed Microsoft AD, particularly in terms of advanced features and scalability.

2. SAML-Based SSO: Integrating SAML-based SSO for WorkSpaces using AWS Identity Center as an intermediary and Microsoft Entra ID as the primary IdP is possible. However, this setup typically still requires a directory service backend for WorkSpaces. You would need to use the directory service (like Simple AD) for WorkSpaces management, while authentication would be handled through SAML.

3. Persistent WorkSpaces: Persistent WorkSpaces can be configured with Simple AD. Each user would still have a dedicated, persistent WorkSpace that they can access securely.

4. Clipboard Redirection Restrictions: Clipboard restrictions can be enforced through WorkSpaces client policies. These policies are generally independent of the directory service used. You can create and apply policies to restrict clipboard functionality regardless of the authentication method.

Key Considerations:

1. While you can use Simple AD instead of AWS Managed AD, there isn't currently a fully directory-less option for persistent WorkSpaces that supports SAML integration out-of-the-box.

2. User authentication can be managed through AWS Identity Center and SAML, but WorkSpaces still requires a directory service for management purposes. The directory service (e.g., Simple AD) would be used for WorkSpace creation and management, while actual user authentication would go through the SAML flow.

3. Clipboard restrictions and other client controls can be enforced using WorkSpaces client policies. These policies work independently of the directory service and should not be affected by using SAML for authentication.

4. Limitations and caveats:

   • You'll still need to manage user accounts in both the directory service and your IdP.
   • Some advanced features available in AWS Managed Microsoft AD might not be available with Simple AD.
   • Ensure that your SAML configuration properly maps user identities between your IdP and the WorkSpaces directory.

In summary, while you can't completely eliminate the need for a directory service with WorkSpaces, you can minimize its role by using Simple AD for WorkSpaces management, leveraging SAML for authentication through AWS Identity Center and Entra ID, and applying client policies for restrictions like clipboard control. This approach balances your requirements with the current limitations of WorkSpaces architecture.
Sources
Set up Active Directory to manage WorkSpaces | AWS re:Post
VPC design - Best Practices for Deploying WorkSpaces
AD DS deployment scenarios - Best Practices for Deploying WorkSpaces