AWS WorkSpaces
Deep Dive 2026

WorkSpaces Terraform Example

# Provision WorkSpaces via Terraform
terraform {
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
}

# WorkSpaces directory registration:
resource "aws_workspaces_directory" "corp" {
  directory_id = aws_directory_service_directory.managed_ad.id
  subnet_ids   = [aws_subnet.ws_a.id, aws_subnet.ws_b.id]
  
  self_service_permissions {
    rebuild_workspace            = true
    change_compute_type          = false
    switch_running_mode          = true
    increase_volume_size         = true
    restart_workspace            = true
  }
  
  workspace_creation_properties {
    enable_internet_access       = false
    enable_maintenance_mode      = true
    user_enabled_as_local_administrator = false
    default_ou                   = "OU=WorkSpaces,DC=corp,DC=local"
  }
}

# Individual WorkSpace:
resource "aws_workspaces_workspace" "user_ws" {
  directory_id = aws_workspaces_directory.corp.id
  bundle_id    = data.aws_workspaces_bundle.performance.id
  user_name    = "jsmith"
  
  workspace_properties {
    compute_type_name             = "PERFORMANCE"
    user_volume_size_gib          = 100
    root_volume_size_gib          = 80
    running_mode                  = "AUTO_STOP"
    running_mode_auto_stop_timeout_in_minutes = 60
  }
  
  tags = { Environment = "prod", Dept = "Finance" }
}

WorkSpaces Pools Terraform

# WorkSpaces Pools (non-persistent)
resource "aws_workspaces_connection_alias" "pool" {
  connection_string = "pools.corp.example.com"
}

resource "aws_workspaces_pool" "task_workers" {
  name         = "task-worker-pool-2026"
  bundle_id    = data.aws_workspaces_bundle.standard.id
  directory_id = aws_workspaces_directory.corp.id
  description  = "Non-persistent task worker pool"
  
  application_settings {
    status                        = "ENABLED"
    settings_group                = "PROD_POOL"
  }
  
  timeout_settings {
    disconnect_timeout_in_seconds             = 3600   # 1hr
    idle_disconnect_timeout_in_seconds        = 1800   # 30min
    max_user_duration_in_seconds              = 86400  # 24hr
  }
  
  capacity {
    desired_user_sessions = 50  # scale as needed
  }
  
  tags = { Environment = "prod" }
}

Thin Client Key Details

• ▸Price: ~$195 device + $7/device/month management fee
• ▸OS: AWS-managed Fire TV OS variant (not Windows)
• ▸Provisioning: Zero-touch via environments — plug in, auto-configure
• ▸Managed via: AWS Console → WorkSpaces Thin Client → Environments
• ▸Software updates: AWS-managed, automatic
• ▸Connects to: WorkSpaces Personal, WorkSpaces Pools, AppStream 2.0
• !Limitation: No local apps — only remote sessions. Web browser only on device.

Key CloudWatch Metrics

CloudWatch Alarm Setup (CLI)

# Alert when connection failure rate spikes:
aws cloudwatch put-metric-alarm \
  --alarm-name "WorkSpaces-ConnFailures" \
  --namespace "AWS/WorkSpaces" \
  --metric-name ConnectionFailure \
  --dimensions Name=DirectoryId,Value=d-xxxx \
  --period 300 \
  --evaluation-periods 2 \
  --threshold 5 \
  --comparison-operator GreaterThanThreshold \
  --statistic Sum \
  --alarm-actions arn:aws:sns:us-east-1:xxxx:vdi-alerts

# View all WorkSpaces CloudWatch metrics:
aws cloudwatch list-metrics \
  --namespace "AWS/WorkSpaces" \
  --query 'Metrics[*].MetricName' \
  --output table