Amazon WorkSpaces applications

Amazon WorkSpaces applications Cheat Sheet

Amazon WorkSpaces Applications (formerly AppStream 2.0) is a fully managed application streaming service that provides users with instant access to their desktop applications from anywhere.

Key Features

AppStream 2.0 includes a set of core features designed to simplify application delivery, improve scalability, and provide secure remote access. These capabilities allow administrators to manage applications centrally while ensuring users can run them smoothly from virtually anywhere.

1. Application Streaming: Run and deliver desktop applications without installing them locally.
2. Scalable Architecture: Automatically scales based on user demand.

3. Secure Access: Supports SAML 2.0 authentication and integrates with AWS IAM.
4. Fleet Management: Launch and manage fleets of streaming instances for different user groups.
5. Data Integration: Works with Amazon S3, EFS, and WorkSpaces for file persistence.
6. Custom Images: Create and deploy pre-configured application images for consistency.
7. Agent Access (MCP): Enable AI agents to interact with desktop applications using Model Context Protocol (MCP). Agents can click buttons, enter text, and capture screenshots. Authenticate using AWS IAM credentials with SigV4 signing. Monitor activity through CloudTrail and CloudWatch.
8. Multi-session fleets: Host multiple user sessions on a single fleet instance to maximize infrastructure utilization and lower costs. Available on Windows-based Always-On and On-Demand fleets.
9. Fleet types: Choose from three fleet types:
10. Always-On: Instances run all the time. Users stream instantly. Pay running instance fee even when idle.
11. On-Demand: Instances run only during active sessions. Pay running fee for active sessions; lower stopped fee when idle.
12. Elastic: Pool managed by WorkSpaces Applications. Pay only for the duration of the streaming session, in seconds.Non-persistent desktops: Delivers a fresh, secure environment at every sign-in with multi-session support.

     

     

13. Model Context Protocol (MCP) tools: Enable AI agents to operate desktop applications with computer input (click, type, scroll) and computer vision (screenshots).

Benefits

The benefits of AppStream 2.0 focus on reducing IT overhead, enhancing security, and providing seamless user experiences. It helps organizations optimize costs and improve operational efficiency while ensuring that users always have up-to-date applications.

1. No Local Installation Needed: Users can access apps instantly through a web browser.
2. Enhanced Security: Keeps applications and data within AWS, reducing data leakage risks.
3. Cost Efficiency: Pay only for active streaming hours, not idle infrastructure.
4. Performance: Delivers high responsiveness using AWS GPU and CPU instance types.
5. Simplified Management: Easily update or manage applications centrally without endpoint maintenance.
6. Enable AI agents to take action: AI agents can interact with desktop applications the same way users do, with agentic capabilities for WorkSpaces.
7. Reduce downtime: Fully managed service backed by a 99.9% uptime SLA.
8. Empower remote workers: Auto-scaling to avoid overprovisioning.

Security

AppStream 2.0 is built with multiple layers of security to protect applications, user data, and access. It integrates with AWS security services, providing administrators fine-grained control over authentication, encryption, and network access to meet compliance requirements.

1. Access Control: Supports AWS IAM, SAML 2.0, and directory integration to manage user permissions.
   
2. Data Protection: Streams applications without storing data on local devices; integrates with encrypted S3/EFS storage.
   
3. Network Security: Can run in VPCs with security groups and private subnets; supports SSL/TLS encryption for streaming traffic.
   
4. Audit & Monitoring: Integrates with AWS CloudTrail and CloudWatch for logging and monitoring user activity and system events.
5. Compliance: Helps meet standards like SOC 2, ISO 27001, HIPAA, and GDPR when properly configured.
6. Agent access: Agents authenticate using standard AWS IAM credentials with SigV4 signing. No API keys or static secrets required.
7. Agent session logging: Agent activity is logged in AWS CloudTrail. Operational metrics are available in CloudWatch.
8. MCP service: The managed MCP service (agentaccess-mcp) provides AI agents with tools to operate the desktop during streaming sessions. Agents connect at a fixed endpoint using IAM credentials.

Pricing

WorkSpaces Applications pricing is based on:

• Streaming instances: Charged per instance-hour consumed. Pricing varies by instance type, size, operating system, and fleet type (Always-On, On-Demand, or Elastic). Elastic fleets and Linux instances are billed per-second with a 15-minute minimum.
• User fees: For Windows fleets, each user who starts a streaming session incurs a monthly Microsoft RDS SAL fee (single-session: $4.19/user/month; multi-session: $6.42/user/month). No user fee for Linux instances.
• Image builder and app block builder: Charged per instance-hour when running.
• Additional storage: 200 GB included per instance. Additional storage beyond 200 GB incurs extra charges.
• Public IPv4 addresses: Standard public IPv4 address charges apply.
• AI agent sessions: Charged per second for active agent session time. Free tier: 10 free hours per Region per month.

For current pricing details, refer to the official Amazon WorkSpaces Applications pricing page.

Amazon WorkSpaces applications Cheat Sheet References:

https://aws.amazon.com/workspaces/applications/

https://docs.aws.amazon.com/appstream2/latest/developerguide/what-is-appstream.html

https://aws.amazon.com/workspaces/applications/pricing/