IAM / compute / workspaces

AWS WorkSpaces (IAM)

AWSworkspacescompute

Amazon WorkSpaces provides a fully managed, secure Desktop-as-a-Service (DaaS) solution to provision virtual desktops in the cloud.

iamaws

docs ↗

Permissions

Actions in this service

workspaces:DescribeWorkspaces

workspaces:DescribeWorkspacesPools

workspaces:DescribeWorkspaceBundles

workspaces:DescribeWorkspaceImages

workspaces:DescribeIpGroups

workspaces:DescribeAccount

workspaces:DescribeTags

workspaces:DescribeConnectionAliases

Policy

Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspacesPools", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeWorkspaceImages", "workspaces:DescribeIpGroups", "workspaces:DescribeAccount", "workspaces:DescribeTags", "workspaces:DescribeConnectionAliases" ], "Resource": "*" } ] }

SDK mapping

Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns

Known gotchas

Avoid workspaces:* — grants full control including creating, modifying, and deleting WorkSpaces, images, and bundles

Avoid workspaces:CreateWorkspaces and workspaces:StopWorkspaces — can provision or disrupt virtual desktops without proper authorization

Resources

docshttps://servicereference.us-east-1.amazonaws.com/v1/workspaces/workspaces.json ↗