WorkSpaces DR / Standby Region Configuration

WorkSpaces Manager supports the automatic creation of standby WorkSpaces in a secondary AWS region for disaster recovery purposes. To enable this functionality, the same user directory used in the primary region must also be available in the standby region. This is typically achieved by creating an AD Connector in the standby region that points to the same Active Directory as the primary region.

Once the standby directory has been created, the standby region and directory must be configured in WorkSpaces Manager.

Enable Multi Region Resilience

Navigate to Configurations > Settings > WorkSpaces (Personal) and enable Multi Region Resilience. This allows WorkSpaces Manager to automatically create a Standby WorkSpace in the configured DR region. You can also enable Remove Standby on Termination if you want the Standby WorkSpace to be automatically removed when the Primary WorkSpace is terminated.

Configure the Standby Region

Navigate to Resources > Regions and add the standby AWS region if it is not already present. For example:

• Region Name: London

• System Name: eu-west-2

After the region has been added, navigate to Update > Directories and run the directory update process to discover the new directory.

Once discovery has completed, navigate to Configurations > Settings > Active Directory, select the newly discovered Directory ID, complete the required configuration settings, and save the changes.

Configure Encryption (Optional)

If WorkSpaces encryption uses custom KMS keys, a multi-region KMS key must be configured in both the primary and standby regions. See KMS Multi-Regions for detailed instructions.

Configure the Standby Directory

Navigate to Resources > Directories and open the primary directory.

Select the standby directory using the Standby Directory ID field, then click Replicate to Standby and Save changes.

Once configured, WorkSpaces Manager automatically creates a standby WorkSpace in the configured DR region whenever a WorkSpace is detected in the primary region.

For Auto-Provisioning (AP) Profiles, the standby creation process begins after the primary WorkSpace has completed provisioning and been detected by WorkSpaces Manager.

Standby WorkSpace creation can take up to 30 minutes after the primary WorkSpace becomes available.

The AD Connector in both regions must point to the same Active Directory, and users must resolve to the same Security Identifier (SID) in both regions.

Troubleshooting

User Not Found

Verify that the AD Connector in both regions can communicate with the same Active Directory and successfully resolve the user account.

Custom KMS Key Missing

Verify that:

• A multi-region KMS key has been created

• A replica key exists in the standby region

• Both directories are configured to use the correct key

Standby WorkSpace Not Created

Verify that:

• The standby region has been added to WorkSpaces Manager

• The standby directory has been configured

• Multi Region Resilience has been enabled

• No provisioning errors are present in the WorkSpaces Manager logs

To prevent a Standby WorkSpace from being created apply the NoStandBy tag. Any value can be used, as the presence of the tag alone prevents standby provisioning.