Specify Active Directory details for your WorkSpaces Pools directory

For Organization Unit, enter the OU that the pool belongs to. WorkSpace machine accounts are placed in the organizational unit (OU) that you specify for the WorkSpaces Pool directory.

For Directory domain name, enter the fully qualified domain name (FQDN) of the Active Directory domain (for example, corp.example.com). Each AWS Region can have only one directory config value with a specific directory name.

For Service account, continue to the Specify the service account for your AD next section of this page.

Open the AWS KMS console at https://console.aws.amazon.com/kms.

To change the AWS Region, use the Region selector in the upper-right corner of the page.

Choose Create a key, and then choose Next.

Choose Symetric for the key type, and Encrypt and decrypt for the key usage, and then choose Next.

Enter an alias for the key, such as WorkSpacesPoolDomainSecretKey, and then choose Next.

Don't choose a key administrator. Choose Next to continue.

Don't define key usage permissions. Choose Next to continue.

In the Key policy section of the page, add the following:

        {
            "Sid": "Allow access for Workspaces SP",
            "Effect": "Allow",
            "Principal": {
                "Service": "workspaces.amazonaws.com"
            },
            "Action": "kms:Decrypt",
            "Resource": "*"
        }

The result should appear like the following example.

Choose Finish.

Your AWS KMS customer managed key is now ready to be used with Secrets Manager. Continue to the Step 2: Create Secrets Manager secret to store your AD service account credentials section of this page.

Open the AWS Secrets Manager console at https://console.aws.amazon.com/secretsmanager/.

Choose Create a new secret.

Choose Other type of secret.

For the first key/value pair, enter Service Account Name for the key, and the name of the service account for the value, such as domain\username.

For the second key/value pair, enter a Service Account Password for the key, and the password of the service account for the value.

For the encryption key, choose the AWS KMS customer managed key that you created earlier, and then choose Next.

Enter a name for the secret, such as WorkSpacesPoolDomainSecretAD.

Choose Edit permissions in the Resource permissions section of the page.

Enter the following permission policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "workspaces.amazonaws.com"
                ]
            },
            "Action": "secretsmanager:GetSecretValue",
            "Resource": "*"
        }
    ]
}

Choose Save to save the permission policy.

Choose Next to continue.

Don't configure automatic rotation. Choose Next to continue.

Choose Store to finish storing your secret.