Differences between desktop client and browser access

Question

I am trying to understand key differences between access using the desktop client and the browser.  I already have a restrictive policy in place, disabling such things as file_upload, file_download, printing_to_local_device, copy_to_local_device.

I have reviewed the list of additional features found here [Client for Windows > Features](https://docs.aws.amazon.com/appstream2/latest/developerguide/client-application-windows-features-user.html). My understanding is that with the permissions already disabled, these new features like ability to use USB devices, access to local drives etc will not be enabled on the desktop client and requires no additional steps?

So I am wondering if there are any other key differences between the two, besides the listed features, that could pose a security concern ?
Or is the behaviour identical ?

AmritaAWS · Answer

Desktop Client vs Browser Access Security Considerations
Existing Policy Protection - With your current restrictive policy (disabling file_upload, file_download, printing_to_local_device, copy_to_local_device), most additional security risks are already mitigated. However, there are nuanced differences to consider:
**Key Differences**

**Local System Integration**
* Desktop client has deeper system-level access
* Browser access is more sandboxed and isolated
* Desktop client can potentially interact more directly with local resources

**Potential Additional Security Considerations**
* Background process persistence
* System tray/notification interactions
* Potential for additional local caching
* More complex authentication token management

**Recommended Verification Steps**

* Confirm policy enforcement across both access methods
* Review AWS documentation for specific desktop client security configurations
* Consider additional logging and monitoring for desktop client access
* Validate that your existing restrictive policy fully translates to desktop client

**Recommendation**

* While your current policy provides strong protection, I recommend:
* Conducting a comprehensive security assessment
* Enabling additional logging for desktop client access
* Periodically reviewing access logs and configurations

Differences between desktop client and browser access

Add your answer

Relevant content