VDI and Secure Remote Workforce on AWS (2026): WorkSpaces Secure Browser vs Applications vs Full Desktop

AWS lifecycle notice (June 30, 2026) — Amazon WorkSpaces PCoIP and WorkSpaces Pool are entering sunset. Plan migration to WorkSpaces Streaming Protocol (WSP) or AppStream. Full matrix: lifecycle roundup.

Most enterprise remote-access programs still buy one thing: a full Windows desktop in the cloud. That made sense when every workflow ran a fat client. In 2026, a large share of contractor and partner work is browser-only — SaaS CRM, internal React apps, vendor portals — while a smaller cohort still needs AutoCAD, legacy ERP, or IDE-heavy environments. AWS split the problem into layers: Amazon WorkSpaces Secure Browser (isolated web), Amazon WorkSpaces Applications (the current product name for AppStream 2.0 application streaming), and WorkSpaces Personal/Core for full desktops.

December 2025 added WebAuthn redirection for Secure Browser on Chromium (Chrome 136+, Edge 137+) — FIDO2 and passkeys work without abandoning session isolation. This post is a decision guide and hardening baseline, not a console click-through.

We ship a VDI platform decision matrix, session hardening checklist, cost model worksheet, and secure remote workforce draw.io.

Benchmark pattern (not a cited client) — Composite regulated professional services firm, ~2,400 users: ~2,000 staff on managed laptops (MDM), ~400 contractors needing mixed access. Legacy: 3 VDI/VPN vendors, Graphics desktops for users who only opened Chrome + one .NET ERP client. After split: Secure Browser portals for ~320 browser-only contractors, WorkSpaces Applications fleets for ~80 CAD/ERP users, zero new full desktops for the browser cohort. Unmanaged-endpoint security incidents tied to contractor access dropped ~9/quarter → ~2/quarter (clipboard exfil + stale VPN profiles). Streaming spend moved from ~$42/seat/mo (Graphics default) to ~$11/seat/mo blended on the browser cohort per the worksheet assumptions.

Pick the lowest layer that works

Opinionated take: Secure Browser first for contractors. Applications when a specific installed app is non-negotiable. Full desktop only when OS-level tooling is proven — not because procurement’s RFP template says “VDI.”

Architecture pattern (all layers)

IdP (SAML) → IAM Identity Center → Portal / Fleet
                                      ↓
                              Private VPC subnets
                                      ↓
                         Internal apps / SaaS / S3 assets
                                      ↓
                         CloudWatch Logs + KMS encryption

Identity flows through SAML 2.0 — do not create local streaming users. Network: streaming fleets and Secure Browser portals in private subnets with interface VPC endpoints for AWS APIs; reach internal apps via Route 53 Resolver rules, not public internet hairpins.

For AWS Console-only users, skip VDI entirely — management console private access plus Identity Center is cheaper and easier to audit.

WorkSpaces Secure Browser

Use when:

• Contractors access SaaS or internal web apps only
• You cannot install agents on personal devices
• You need clipboard/print disabled by policy

Configure:

• Portal VPC association to subnets that can reach internal ALBs
• Disable clipboard and file upload unless legal approves
• Enable WebAuthn redirection (Dec 2025) if sites require FIDO2 — admin portal setting + WebAuthenticationRemoteDesktopAllowedOrigins on local Chromium

WorkSpaces Applications

Use when:

• One or few Windows/Linux applications (ERP, CAD, IDE) — not a full desktop worth of tools
• Sessions should be non-persistent and isolated per user
• You want a single application catalog version — no per-user MSI drift

Rightsize fleets: standard bundles for office apps; Graphics only after profiling proves GPU need. Idle disconnect saves stream-hour spend — see the worksheet.

Full WorkSpaces desktops

Use when:

• Developers need local admin-adjacent tooling, multiple heavy apps, or persistent profiles
• WorkSpaces Core for Active Directory–joined enterprise desktops
• WorkSpaces Personal for standalone persistent desktops without AD

January 2026 added Microsoft Office/Visio/Project 2024 to the WorkSpaces managed applications catalog — charge is separate from the base bundle; model it in the worksheet before promising “included Office.”

What broke — Day 1 contractor pilot on Secure Browser. Users authenticated via SAML then saw a blank page on an internal HR app. Network team had allowed HTTPS to the internet but not Resolver forwarding for corp.internal zones. Fix: associate portal with subnets that use the inbound/outbound Resolver endpoints; add conditional forwarding rule — not a streaming protocol issue. Second week: audit flagged clipboard enabled on a contractor portal used for CRM — disabled in portal policy; incidents dropped the next quarter.

Hardening before go-live

Run the session hardening checklist:

• MFA at IdP, group-based portal mapping
• Private subnets, least-privilege SG egress
• Session logging to CloudWatch / S3
• Stuck-session and credential-compromise runbook

Encrypt persistent user volumes with CMK where policy requires — align key policies with streaming service roles per KMS architecture.

Cost discipline

Do not budget from vendor slide decks. Copy the cost model worksheet, fill seat counts and stream hours per cohort, and compare blended $/user/month across layers. The benchmark firm’s win was layer split, not a magic discount.

What to do this week

1. Classify users into browser-only, app-only, and full-desktop cohorts — count each.
2. Pilot Secure Browser for the largest contractor browser cohort — one internal app + one SaaS app.
3. Inventory Graphics fleets — downgrade users who never touch GPU in session logs.
4. Run the hardening checklist on one portal and one fleet before expanding OU scope.
5. Wire IdP groups — one entitlement group per portal/fleet, not per user.

What this post doesn’t cover

• Mobile device MDM for native apps — out of scope for streaming.
• Amazon Connect / contact-center agent desktops — different latency and peripheral requirements.
• GovCloud / IL5 accreditation boundaries — confirm service availability and ATO overlays separately.
• Third-party VDI (Citrix, Omnissa) on EC2 — lift-and-shift path when AWS streaming feature gaps are proven, not assumed.
• Deep AppStream image builder automation — see AWS documentation for image builders and fleet scaling.

Related: Console private access · KMS architecture · Enterprise governance · SOC 2 on AWS · Cloud security services

Frequently asked questions

What is the difference between WorkSpaces Secure Browser and WorkSpaces Applications?

WorkSpaces Secure Browser is a fully managed, cloud-hosted browser that streams web content to the user existing Chromium browser — ideal for SaaS and internal web apps without installing a desktop agent. WorkSpaces Applications (the current name for AppStream 2.0) streams individual Windows or Linux applications from a fleet to a browser tab — ideal for CAD, ERP, or legacy fat clients that are not web-based. Secure Browser is lower cost and smaller attack surface when the job is web-only; Applications when the job is a specific installed application.

When should we use a full WorkSpaces desktop instead of application streaming?

Choose WorkSpaces Personal or Core when users need OS-level tooling — multiple heavy apps simultaneously, local dev environments, traders with many monitors, or persistent user profiles with admin-adjacent workflows. Full desktops cost more (always-on bundles or long stream hours) and expand exfiltration surface (clipboard, drives, printing). If 80% of users only open a browser and one .NET client, split: Secure Browser for the browser cohort, Applications for the .NET app — not one Graphics desktop for everyone.

When should we NOT deploy AWS VDI streaming?

Skip streaming when users only need AWS Console access (use IAM Identity Center and console private access), when workloads are mobile-native apps, or when OT floors need offline edge compute (Greengrass, not WAN streaming). Also avoid defaulting to Graphics fleets for standard office workers — rightsizing failures show up as $/seat, not architecture diagrams. If compliance requires fully managed corporate laptops with MDM, streaming adds complexity unless contractors are the primary audience.

How does identity federation work for WorkSpaces streaming?

WorkSpaces Secure Browser and WorkSpaces Applications integrate with SAML 2.0 identity providers — commonly IAM Identity Center or an corporate IdP (Okta, Entra ID). Users authenticate once at the IdP; AWS maps SAML attributes to portals, fleets, or stacks. Avoid local streaming users. Pair with group-based entitlements: one portal per contractor class, not per individual. MFA should be enforced at the IdP, not disabled for streaming convenience.

What changed recently for WorkSpaces Secure Browser?

In December 2025 AWS added WebAuthn redirection for Secure Browser on Chromium browsers (Chrome 136+, Edge 137+), letting users authenticate to websites with FIDO2 keys or platform authenticators while the browsing session stays isolated in AWS. Administrators enable redirection in portal settings and configure the WebAuthenticationRemoteDesktopAllowedOrigins policy on local browsers. This reduces password re-entry for phishing-resistant auth without moving browsing off the isolated session.

What could go wrong during rollout?

Three recurring failures: (1) Security groups block the streaming protocol — users see a black screen after SAML login; fix SG egress/ingress on fleet ENIs. (2) Secure Browser portal VPC association cannot reach internal apps — missing Route 53 Resolver rule or wrong subnet routing. (3) Clipboard redirection left enabled on contractor portals — data exfiltration risk reported in audit. Use the session hardening checklist artifact before go-live.