Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

IAM Policies in JSON format

If you cannot use Terraform automation, you can also use different method for the custom policies.

Updated 6th May 2026

If Terraform automation is not an option, you can still use your preferred method to create the custom policies. This could include using the AWS Management Console, AWS CLI, or other Infrastructure-as-Code (IaC) tools like CloudFormation to create the required IAM policies can be created manually in the AWS Console and attached to the WorkSpaces Manager EC2 role.

These policies provide the permissions required for WorkSpaces Manager to interact with AWS services used by the platform, including Amazon WorkSpaces, Directory Service, AppStream, tagging APIs, and KMS where encrypted WorkSpaces volumes are used.

The JSON policy examples below can be copied directly into the AWS Console when creating the required customer-managed IAM policies. These policies are based on the WSM IAM policy and role deployment repository.

We have defined a number of IAM Policies:

  1. WSMCloudwatchPolicy to read from logs and alarms CloudWatch

  2. WSMCostExplorerPolicy to access AWS Cost Explorer and Cost Optimizer features

  3. WSMEC2Policy to read from EC2 Compute and manage some actions

  4. WSMEUCPolicy to read from AppStream, Directory Services (AD Connectors also) and WorkSpaces services

  5. WSMPricingPolicy to access AWS Pricing elements

  6. WSMS3Policy to read from the Cost Optimizer Bucket

  7. WSMSecretsPolicy to read from Secrets Manager

  8. WSMSSMParameterStorePolicy to get data from Systems Manager Parameter Store

Here is the JSON snippet for the custom policy "WSMCloudwatchPolicy":

{
    "Statement": [
        {
            "Action": [
                "cloudwatch:DescribeAlarmHistory",
                "cloudwatch:DescribeAlarmsForMetric",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:Describe*",
                "cloudwatch:GetDashboard",
                "cloudwatch:GetMetricData",
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:GetMetricWidgetImage",
                "cloudwatch:ListMetrics",
                "logs:GetLogEvents",
                "logs:FilterLogEvents",
                "logs:GetLogGroupFields",
                "logs:GetQueryResults",
                "logs:GetLogDelivery",
                "logs:GetLogRecord",
                "logs:StartQuery",
                "logs:StopQuery",
                "logs:TestMetricFilter"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "VisualEditor0"
        }
    ],
    "Version": "2012-10-17"
}

This policy grants permissions to interact with CloudWatch Logs and CloudWatch Groups, allowing the WorkSpaces Manager to record and retrieve necessary metrics and logs. You can apply this policy through your preferred method, whether it's the AWS Management Console, CLI, or automation tools.

Here is the JSON snippet for the custom policy "WSMCostExplorerPolicy":

This policy grants the necessary permissions for WorkSpaces Manager to access Cost Explorer and retrieve cost and usage data, as well as reservation and savings plan information. You can apply this policy using the AWS Management Console, CLI, or any automation tools like Terraform or CloudFormation.

Here is the JSON snippet for the custom policy "WSMEC2Policy":

This policy allows WorkSpaces Manager to manage EC2 instances, including actions like starting, stopping, rebooting, terminating, and describing instances and tags. You can use this policy in the AWS Management Console, CLI, or automation tools such as Terraform or CloudFormation.

Here is the JSON snippet for the custom policy "WSMEUCPolicy":

This policy provides WorkSpaces Manager with the permissions needed to interact with Amazon WorkSpaces, including describing, creating, terminating, and managing WorkSpaces and their tags. You can apply this policy using the AWS Management Console, CLI, or tools like Terraform or CloudFormation.

Here is the JSON snippet for the custom policy "WSMPricingPolicy":

This policy grants WorkSpaces Manager permission to retrieve pricing information using the AWS Pricing API. You can apply this policy using the AWS Management Console, CLI, or automation tools like Terraform or CloudFormation.

Here is the JSON snippet for the custom policy "WSMS3Policy":

This policy grants WorkSpaces Manager permission to interact with Amazon S3, including listing, getting, putting, and deleting objects in the specified S3 bucket. You can apply this policy via the AWS Management Console, CLI, or tools like Terraform or CloudFormation.

Here is the JSON snippet for the custom policy "WSMSecretsPolicy":

This policy grants WorkSpaces Manager permission to retrieve and read secrets stored in AWS Secrets Manager, including database connection details and application credentials. This allows sensitive configuration information to be securely managed outside of the EC2 instance rather than being stored locally on the server. You can apply this policy using the AWS Management Console, CLI, or automation tools like Terraform or CloudFormation.

Here is the JSON snippet for the custom policy "WSMSSMParameterStorePolicy":

This policy grants WorkSpaces Manager permission to read, create, update, and delete parameters stored in AWS Systems Manager Parameter Store. This is used to securely manage application configuration values, operational settings, and integration parameters outside of the EC2 instance configuration for the Load Balancer. You can apply this policy using the AWS Management Console, CLI, or automation tools like Terraform or CloudFormation.

JSON templates can also be downloaded from this repo.

PreviousGPO Scheduled Task Setup
NextAWS CLI v2

Last updated