With over 1,200 WorkSpaces deployed globally, manual patching and configuration management are not just inefficient; they are a direct violation of compliance mandates. This is where AWS Systems Manager (SSM) becomes indispensable. By treating our WorkSpaces fleet as managed nodes, we can automate patching, enforce configurations, and maintain real-time visibility, all without direct server access.

WorkSpaces are not standard EC2 instances, so they can't be automatically managed by SSM out of the box. They must be registered as part of a hybrid environment. For a large fleet, the only scalable solution is to automate this registration using the existing Active Directory infrastructure. The process relies on a GPO to execute a script during instance startup.

First, you create a Hybrid Activation in the SSM console for your target region and account. This generates an Activation Code and Activation ID. These credentials authorize a machine to register with your SSM environment. Store these securely in AWS Secrets Manager.

Next, create a Group Policy Object and link it to the Organizational Unit (OU) containing your WorkSpaces computer accounts. The GPO will execute a startup script that retrieves the activation credentials from Secrets Manager and runs the SSM agent's registration command. This ensures every new and existing WorkSpace automatically appears as a managed node in SSM, ready for centralized management.

Our security posture dictates that WorkSpaces have no direct internet access; all egress traffic is inspected by Palo Alto firewalls. To allow the SSM agent to function in this locked-down environment, we use VPC endpoints, powered by AWS PrivateLink

You must deploy three specific interface endpoints into the WorkSpaces VPCs in each region. These endpoints create private, redundant connections to the AWS services that SSM depends on, keeping all communication within the AWS network backbone.

By attaching an endpoint policy that only allows access from your VPC's CIDR range, you ensure these private connections cannot be misused. The SSM agent automatically discovers and prioritizes these endpoints, requiring no agent-side configuration.

With our fleet registered and communicating securely, we can implement automated patching. SSM Patch Manager allows us to define and enforce patching rules across all 1,200+ instances.

Instead of relying on default rules, we create a custom patch baseline. This gives us granular control. For example, we can approve all Critical and Important security updates automatically but add a 7-day delay for other updates to allow for internal testing. We can also explicitly block specific patches (like KB articles known to cause issues with our applications) or approve non-security updates from a curated list.

Finally, SSM Fleet Manager provides a unified dashboard for real-time visibility. It consolidates inventory data, patch compliance status, and performance counters from every managed node. If a WorkSpace is non-compliant with our patch baseline, it's flagged immediately. We can even use Fleet Manager to securely access the file system or view Windows event logs without needing to initiate a remote desktop session, dramatically speeding up troubleshooting.