Amazon WorkSpaces Core - Creating and Preparing Sources for Horizon 8 Automated Desktop Pool Provisioning

This page describes using Amazon WorkSpaces Core workspaces as the sources for a Horizon 8 automated desktop pool.

The ability to use Amazon WorkSpaces Core as a source for an automated desktop pool debuted in Horizon 2406.

For an in-depth article that covers deploying Horizon with Amazon EC2 and Amazon WorkSpaces overall, including using Amazon WorkSpaces as the sources for pools, see Tech Zone's Deploying Omnissa Horizon with Amazon EC2 and Amazon WorkSpaces.

Single-Session Virtual Desktops OS Support

As of this writing, the Horizon 8 automated desktop pool provisioning features for single-session virtual desktops can be used with:

• Windows 10 and Windows 11 instances of Amazon Workspaces Core
• AWS provided public WorkSpaces Core bundles (BYOP) for Windows Server 2019 and Windows Server 2022, or create your own custom server OS bundle and image tailored to your requirements. This Windows Server support is available in AWS regions where Amazon WorkSpaces Core is available.

Important: When you're going to use a Windows Server OS as the base of a single-session desktop, before you install the Horizon Agent in the OS, you must first prepare the OS as described in steps in Prepare Windows Server Operating Systems for Desktop Use.

Terminology

Even though some of the terms used in Amazon WorkSpaces Core are different than the terms used in vSphere, much of the high-level principles are the same.

• Amazon WorkSpaces Bundle - The Amazon WorkSpaces Core bundle is a preconfigured combination of compute, storage, and software resources, and an operating system (image) that you can use to launch a virtual desktop in Amazon WorkSpaces Core.
• Image - A custom image contains only the operating system, installed software, and user-defined settings for the WorkSpace. A custom bundle combines the custom image with the selected hardware specifications, such as compute and storage, that define the configuration of the WorkSpace.

After creating a custom image, you can build a custom bundle by selecting the appropriate compute and storage resources to pair with the image. This custom bundle can then be used to launch new WorkSpaces with a consistent configuration, ensuring standardization across your deployments.

To apply software updates or install additional applications, you can modify your custom bundle and use it to rebuild your WorkSpaces.

Prerequisites

Before proceeding with the remaining steps in this process, you must complete the following prerequisites.

• An existing or new AWS account that has access for Amazon WorkSpaces Core. If you don't have an account, you can create one using the Amazon Web Services home page.
• The Amazon account must have Bring Your Own License (BYOL) enabled. Refer to the Amazon information at Bring Your Own Windows desktop licenses. In Amazon WorkSpaces, the license and protocol are under your control. When using Amazon Workspaces Core with Horizon 8, the supported protocol is the Blast Extreme protocol, which comes from installing the Horizon Agent.
• A Horizon 8 deployment set up and configured that's supported for this use case. This use case requires having a Horizon 8 deployment running on Amazon EC2 machines. The Connection Server is running in Amazon EC2.
• Ensure you have your Amazon WorkSpaces set up.
  • Active Directory - Amazon recommends creating an Active Directory Connector (ADC) for all directories. Horizon 8 does not support Amazon Simple AD. Amazon has this AWS white paper about the role of the AWS AD connector with Amazon WorkSpaces.
  • BYOL images imported into your WorkSpaces.
• Ensure you have set up an IAM role that has the appropriate permissions for Horizon 8 Connection Server to access the WorkSpaces resources. Refer to the Amazon information at Identity and management for WorkSpaces. In AWS, policies are sets of permissions that define what actions the IAM role can perform on specific AWS resources.

Important: Do not enable Maintenance Mode in the Amazon WorkSpaces Directory Configuration. This feature is not available with Amazon WorkSpaces Core and can interfere with the lifecycle management of instances under Horizon management.

IAM Permissions

The following required IAM permissions must be provided in the AWS IAM Console:

• When using a Connection Server deployed in Amazon EC2, the IAM role must be added to the Connection Server's EC2 instance in Amazon EC2. The default is to use an instance profile to pass that IAM role to the Connection Server's EC2 instance (also referred to in the AWS documentation as an AWS service role for an EC2 instance).

• When using a Connection Server deployed on-premises or in a public cloud outside of Amazon EC2, you'll need to provide an IAM User's AWS Access Key ID and Secret Access Key when adding a provider. Apply the IAM role with the required permissions to that IAM user and establish the Access Key ID and Secret Access Key.

• On the IAM role for the Connection Server the following policies provide the required permissions:

  • AmazonSSMDirectoryServiceAccess (AWS managed policy)
  • AmazonSSMManagedInstanceCore (AWS managed policy)
  • Omnissa-CS-admin (Inline Policy)

  {
  "Version" : "2012-10-17",
  "Statement" : [
  {
  "Sid" : "AmazonWorkSpacesAdmin",
  "Effect" : "Allow",
  "Action" : [
  "kms:DescribeKey",
  "kms:ListAliases",
  "kms:ListKeys",
  "workspaces:CreateTags",
  "workspaces:CreateWorkspaceImage",
  "workspaces:CreateWorkspaces",
  "workspaces:CreateStandbyWorkspaces",
  "workspaces:DeleteTags",
  "workspaces:DeregisterWorkspaceDirectory",
  "workspaces:DescribeTags",
  "workspaces:DescribeWorkspaceBundles",
  "workspaces:DescribeWorkspaceDirectories",
  "workspaces:DescribeWorkspaces",
  "workspaces:DescribeWorkspacesConnectionStatus",
  "workspaces:ModifyCertificateBasedAuthProperties",
  "workspaces:ModifySamlProperties",
  "workspaces:ModifyWorkspaceCreationProperties",
  "workspaces:ModifyWorkspaceProperties",
  "workspaces:RebootWorkspaces",
  "workspaces:RebuildWorkspaces",
  "workspaces:RegisterWorkspaceDirectory",
  "workspaces:RestoreWorkspace",
  "workspaces:StartWorkspaces",  
  "workspaces:StopWorkspaces",
  "workspaces:TerminateWorkspaces",
  "workspaces:UpdateWorkspaceBundle",
  "workspaces:DescribeWorkspaceImages"
  ],
  "Resource" : "*"
  }
  ]
  }
  

To use Encrypted Workspaces, add the IAM role used for the Connection Serve to the KMS key administrators group.

Note: IAM permissions must be set up before adding a capacity provider.

For details on how to deploy a Horizon 8 infrastructure on Amazon EC2 machines, see the section Deploying Horizon Infrastructure on Amazon EC2 Machines within Tech Zone.

What to read next

Information	Description
Amazon Workspaces Core – Add a Capacity Provider in Horizon Console	Provides the process for configuring communication between Horizon 8 and Amazon Workspaces Core.
Amazon Workspaces Core – Create the Desktop OS Golden Pattern	Provides the process for creating the Desktop OS Golden Image pattern.
Amazon Workspaces Core – Create the Windows Server Public Bundle Golden Pattern	Provides the process for creating the Windows Server OS Golden Image pattern.
Amazon WorkSpaces Core - Worksheet for Creating an Automated Full-Clone Desktop Pool	Provides the checklist for creating an automated full-clone desktop pool using the pool wizard in Horizon Console.
Amazon WorkSpaces Core - Create an Automated Full-Clone Desktop Pool	Provides the process for creating an automated full-clone desktop pool using the pool wizard in Horizon Console.