Core Infrastructure & Global Connectivity Create a secure, highly available network foundation using VPCs, subnets across Availability Zones, and Transit Gateways to connect global users to their nearest resources.

Security, Compliance & Authentication Implement multi-layered security using firewalls for traffic inspection, MFA for access, encryption for data protection, and comprehensive logging for auditing and threat detection.

Lifecycle Management & Operations Automate the creation, management, and updating of 1,200+ desktops using golden images, Infrastructure as Code, and self-service portals to ensure consistency and efficiency.

Core Infrastructure & Global Connectivity

1. VPC is the Foundation: All resources exist within a Virtual Private Cloud, providing network isolation.
2. Use Multiple AZs: Deploy private subnets across at least two Availability Zones (AZs) for high availability.
3. Size Subnets Correctly: Subnet CIDR blocks must be large enough for all users from the start, as they cannot be resized.
4. NAT Gateway for Updates: A NAT Gateway allows WorkSpaces in private subnets to access the internet for updates without being directly exposed.
5. AD is for Identity: AWS Managed Microsoft AD (Enterprise Edition) is required for multi-region user management.
6. Transit Gateway Connects Regions: Use AWS Transit Gateway to act as a cloud router, connecting VPCs across different global regions.

Security, Compliance & Authentication

1. Inspect All Traffic: Use Palo Alto VM-Series firewalls with a Gateway Load Balancer (GWLB) to inspect all inbound and outbound traffic.
2. User-ID Links Policy to People: User-ID integrates with Active Directory to enforce security policies based on user roles, not just IP addresses.
3. MFA is Non-Negotiable: Integrate a RADIUS server (like Duo) or use SAML 2.0 with the directory service to enforce Multi-Factor Authentication.
4. Encrypt Everything: Use AWS KMS to encrypt WorkSpace volumes at rest, protecting data even if compromised.
5. Prevent Data Leakage: Use Group Policy Objects (GPOs) to disable clipboard redirection, USB access, and local printing.
6. Log and Audit All Actions: AWS CloudTrail logs all API calls, while Amazon GuardDuty detects suspicious activity within the WorkSpaces environment.

Lifecycle Management & Operations

1. Use Golden Images: Create a standardized 'golden image' with all required applications and settings to ensure consistency.
2. Bundles Define Performance: A bundle combines a golden image with specific vCPU and RAM configurations.
3. Automate with Terraform: Use Infrastructure as Code (IaC) with Terraform to automate the provisioning and de-provisioning of WorkSpaces.
4. WSP for Better Performance: The WorkSpaces Streaming Protocol (WSP) generally provides a better user experience on networks with higher latency compared to PCoIP.
5. Use Cost Optimizer: This tool automatically switches WorkSpaces between monthly and hourly billing to minimize costs based on actual usage.
6. Deploy with Blue/Green: Test image updates on a small pilot group (Blue) before rolling them out to all users (Green) to minimize disruption.

Virtual Private Cloud (VPC): A logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define.

• Used in context: The entire WorkSpaces environment for the investment firm was built inside a dedicated VPC to ensure network isolation.
• Topic: Core Infrastructure & Global Connectivity

Availability Zone (AZ): One or more discrete data centers with redundant power, networking, and connectivity in an AWS Region.

• Used in context: We placed our domain controllers in subnets across two different Availability Zones to ensure the directory service survives a data center failure.
• Topic: Core Infrastructure & Global Connectivity

NAT Gateway: A highly available, managed Network Address Translation (NAT) service that allows instances in a private subnet to connect to the internet but prevents the internet from initiating a connection with those instances.

• Used in context: WorkSpaces receive critical Windows updates by routing their outbound traffic through a NAT Gateway, keeping them secure from inbound threats.
• Topic: Core Infrastructure & Global Connectivity

AWS Managed Microsoft AD: A service that provides a fully managed Microsoft Active Directory in the AWS Cloud, run on Windows Server.

• Used in context: We chose the Enterprise Edition of AWS Managed Microsoft AD because it supports the multi-region replication needed for our global user base.
• Topic: Core Infrastructure & Global Connectivity

Gateway Load Balancer (GWLB): A service that makes it easy to deploy, scale, and manage third-party virtual appliances like firewalls by placing them in the path of network traffic.

• Used in context: The GWLB distributes traffic across our fleet of Palo Alto firewalls and automatically reroutes it if one appliance fails.
• Topic: Security, Compliance & Authentication

User-ID: A Palo Alto Networks feature that integrates with directory services (like Active Directory) to associate network traffic with specific users instead of just IP addresses.

• Used in context: With User-ID, we can create a firewall rule that allows only the 'Trading Team' group to access financial data feeds, regardless of which WorkSpace they use.
• Topic: Security, Compliance & Authentication

Terraform: An open-source Infrastructure as Code (IaC) tool that allows you to define and provision data center infrastructure using a declarative configuration language.

• Used in context: We used a Terraform script to automatically create a new WorkSpace every time a user is added to the 'New Hires' group in Active Directory.
• Topic: Lifecycle Management & Operations

Golden Image: A pre-configured template of a virtual machine, server, or in this case, a WorkSpace, which includes the operating system, applications, and all necessary settings.

• Used in context: The IT team maintains a single golden image with Bloomberg, Excel, and security agents installed, ensuring every new WorkSpace is compliant from the start.
• Topic: Lifecycle Management & Operations

RADIUS (Remote Authentication Dial-In User Service): A networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for users who connect to and use a network service.

• Used in context: We integrated our AWS Directory Service with a RADIUS server from Duo to prompt users for a push notification on their phone after they enter their password.
• Topic: Security, Compliance & Authentication

WorkSpaces Streaming Protocol (WSP): A cloud-native streaming protocol from AWS designed to provide a responsive user experience over varying network conditions, especially those with high packet loss or latency.

• Used in context: Our users in Asia connecting to WorkSpaces in Europe reported a much smoother experience after we switched the protocol from PCoIP to WSP.
• Topic: Lifecycle Management & Operations

❌ MISTAKE: Assigning a /24 CIDR block to a subnet intended for 1,200 users.

• Why it happens: A /24 block seems large, but it only provides ~251 usable IP addresses. AWS reserves 5 IPs per subnet, and this is far too small for the user base.
• ✅ Instead: Use a larger CIDR block like /20 or /19 for the VPC and size subnets appropriately (e.g., /22) to ensure enough IP addresses for all 1,200+ users plus future growth. Subnets cannot be resized.
• Topic: Core Infrastructure & Global Connectivity

❌ MISTAKE: Choosing AWS Managed Microsoft AD 'Standard Edition' for a global company.

• Why it happens: Standard Edition is cheaper and seems sufficient for a single-region deployment. However, it does not support multi-region replication.
• ✅ Instead: Always choose 'Enterprise Edition' for any deployment that may need to span multiple AWS regions. This is the only way to replicate the directory globally and provide low-latency authentication for users in different continents.
• Topic: Core Infrastructure & Global Connectivity

❌ MISTAKE: Relying only on Security Groups to protect WorkSpaces.

• Why it happens: Security Groups are a fundamental part of AWS security and can control traffic based on ports and IP addresses, which seems sufficient.
• ✅ Instead: Implement a dedicated firewall solution like Palo Alto VM-Series with a GWLB. This allows for deep packet inspection, application identification (App-ID), and user-based rules (User-ID), providing much stronger security than just port/IP filtering.
• Topic: Security, Compliance & Authentication

❌ MISTAKE: Manually updating the 'golden image' and then manually updating each user's WorkSpace.

• Why it happens: It seems like the most direct way to apply a patch or install new software.
• ✅ Instead: Update the golden image, create a new bundle, and then deploy it using a blue/green strategy. For ongoing updates, use AWS Systems Manager (SSM) to run automated scripts across the entire fleet without manual intervention.
• Topic: Lifecycle Management & Operations

User Login & Security Inspection Flow

Step 1: User Authentication

• What happens: The user enters their credentials. AWS Directory Service validates the password against Active Directory and then triggers the MFA check by contacting the configured RADIUS server (e.g., Duo).
• Key indicator: The user receives a push notification on their phone.

Step 2: Traffic Routing to GWLB

• What happens: Once authenticated, the WorkSpace sends outbound internet traffic (e.g., to a website). The VPC route table directs this traffic to the Gateway Load Balancer (GWLB) endpoint.
• Key indicator: Traffic destined for 0.0.0.0/0 is sent to the GWLB ENI, not the NAT Gateway directly.

Step 3: Firewall Inspection

• What happens: The GWLB forwards the traffic to one of the active Palo Alto VM-Series firewall instances for inspection. The firewall applies App-ID and User-ID policies.
• Key indicator: Logs in the Palo Alto console show traffic being allowed or denied based on user and application rules.

Step 4: Egress to Internet

• What happens: If the traffic is permitted by the firewall, it is sent out to the internet via an Internet Gateway in the security VPC. Return traffic follows the same path back in reverse.
• Key indicator: The user can successfully browse the website.

Visual flow: User Login → MFA Check → Traffic hits GWLB → Palo Alto Firewall Inspects → Traffic exits to Internet

Topic: Security, Compliance & Authentication