[{"data":1,"prerenderedAt":128},["ShallowReactive",2],{"i-heroicons:building-office-2":3,"i-heroicons:computer-desktop":8,"i-heroicons:cloud":10,"i-heroicons:server":12,"i-heroicons:folder":14,"i-heroicons:chart-bar":16,"i-heroicons:lock-closed":18,"i-heroicons:rectangle-stack":20,"i-heroicons:scale":22,"i-heroicons:key":24,"i-heroicons:finger-print":26,"i-heroicons:cpu-chip":28,"i-heroicons:document-text":30,"i-heroicons:shield-exclamation":32,"i-heroicons:shield-check":34,"blog-en-deploy-yubion-portal-in-amazon-workspaces":36,"i-heroicons:user":126},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M2.25 21h19.5m-18-18v18m10.5-18v18m6-13.5V21M6.75 6.75h.75m-.75 3h.75m-.75 3h.75m3-6h.75m-.75 3h.75m-.75 3h.75M6.75 21v-3.375c0-.621.504-1.125 1.125-1.125h2.25c.621 0 1.125.504 1.125 1.125V21M3 3h12m-.75 4.5H21m-3.75 3.75h.008v.008h-.008zm0 3h.008v.008h-.008zm0 3h.008v.008h-.008z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M9 17.25v1.007a3 3 0 0 1-.879 2.122L7.5 21h9l-.621-.621A3 3 0 0 1 15 18.257V17.25m6-12V15a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 15V5.25m18 0A2.25 2.25 0 0 0 18.75 3H5.25A2.25 2.25 0 0 0 3 5.25m18 0V12a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 12V5.25\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M2.25 15a4.5 4.5 0 0 0 4.5 4.5H18a3.75 3.75 0 0 0 1.332-7.257a3 3 0 0 0-3.758-3.848a5.25 5.25 0 0 0-10.233 2.33A4.5 4.5 0 0 0 2.25 15\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M21.75 17.25v-.228a4.5 4.5 0 0 0-.12-1.03l-2.268-9.64a3.375 3.375 0 0 0-3.285-2.602H7.923a3.375 3.375 0 0 0-3.285 2.602l-2.268 9.64a4.5 4.5 0 0 0-.12 1.03v.228m19.5 0a3 3 0 0 1-3 3H5.25a3 3 0 0 1-3-3m19.5 0a3 3 0 0 0-3-3H5.25a3 3 0 0 0-3 3m16.5 0h.008v.008h-.008zm-3 0h.008v.008h-.008z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":15},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M2.25 12.75V12A2.25 2.25 0 0 1 4.5 9.75h15A2.25 2.25 0 0 1 21.75 12v.75m-8.69-6.44l-2.12-2.12a1.5 1.5 0 0 0-1.061-.44H4.5A2.25 2.25 0 0 0 2.25 6v12a2.25 2.25 0 0 0 2.25 2.25h15A2.25 2.25 0 0 0 21.75 18V9a2.25 2.25 0 0 0-2.25-2.25h-5.379a1.5 1.5 0 0 1-1.06-.44\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M3 13.125C3 12.504 3.504 12 4.125 12h2.25c.621 0 1.125.504 1.125 1.125v6.75C7.5 20.496 6.996 21 6.375 21h-2.25A1.125 1.125 0 0 1 3 19.875zm6.75-4.5c0-.621.504-1.125 1.125-1.125h2.25c.621 0 1.125.504 1.125 1.125v11.25c0 .621-.504 1.125-1.125 1.125h-2.25a1.125 1.125 0 0 1-1.125-1.125zm6.75-4.5c0-.621.504-1.125 1.125-1.125h2.25C20.496 3 21 3.504 21 4.125v15.75c0 .621-.504 1.125-1.125 1.125h-2.25a1.125 1.125 0 0 1-1.125-1.125z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M16.5 10.5V6.75a4.5 4.5 0 1 0-9 0v3.75m-.75 11.25h10.5a2.25 2.25 0 0 0 2.25-2.25v-6.75a2.25 2.25 0 0 0-2.25-2.25H6.75a2.25 2.25 0 0 0-2.25 2.25v6.75a2.25 2.25 0 0 0 2.25 2.25\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M6 6.878V6a2.25 2.25 0 0 1 2.25-2.25h7.5A2.25 2.25 0 0 1 18 6v.878m-12 0q.354-.126.75-.128h10.5q.396.002.75.128m-12 0A2.25 2.25 0 0 0 4.5 9v.878m13.5-3A2.25 2.25 0 0 1 19.5 9v.878m0 0a2.3 2.3 0 0 0-.75-.128H5.25q-.396.002-.75.128m15 0A2.25 2.25 0 0 1 21 12v6a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 18v-6c0-.98.626-1.813 1.5-2.122\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":23},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M12 3v17.25m0 0c-1.472 0-2.882.265-4.185.75M12 20.25c1.472 0 2.882.265 4.185.75M18.75 4.97A48 48 0 0 0 12 4.5c-2.291 0-4.545.16-6.75.47m13.5 0q1.515.215 3 .52m-3-.52l2.62 10.726c.122.499-.106 1.028-.589 1.202a6 6 0 0 1-2.031.352a6 6 0 0 1-2.031-.352c-.483-.174-.711-.703-.59-1.202zm-16.5.52q1.485-.305 3-.52m0 0l2.62 10.726c.122.499-.106 1.028-.589 1.202a6 6 0 0 1-2.031.352a6 6 0 0 1-2.031-.352c-.483-.174-.711-.703-.59-1.202z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":25},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M15.75 5.25a3 3 0 0 1 3 3m3 0a6 6 0 0 1-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1 1 21.75 8.25\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":27},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M7.864 4.243A7.5 7.5 0 0 1 19.5 10.5c0 2.92-.556 5.709-1.568 8.269M5.742 6.364A7.47 7.47 0 0 0 4.5 10.5a7.46 7.46 0 0 1-1.15 3.993m1.989 3.559A11.2 11.2 0 0 0 8.25 10.5a3.75 3.75 0 1 1 7.5 0q0 .79-.064 1.565M12 10.5a14.94 14.94 0 0 1-3.6 9.75m6.633-4.596a18.7 18.7 0 0 1-2.485 5.33\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":29},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M8.25 3v1.5M4.5 8.25H3m18 0h-1.5M4.5 12H3m18 0h-1.5m-15 3.75H3m18 0h-1.5M8.25 19.5V21M12 3v1.5m0 15V21m3.75-18v1.5m0 15V21m-9-1.5h10.5a2.25 2.25 0 0 0 2.25-2.25V6.75a2.25 2.25 0 0 0-2.25-2.25H6.75A2.25 2.25 0 0 0 4.5 6.75v10.5a2.25 2.25 0 0 0 2.25 2.25m.75-12h9v9h-9z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M19.5 14.25v-2.625a3.375 3.375 0 0 0-3.375-3.375h-1.5A1.125 1.125 0 0 1 13.5 7.125v-1.5a3.375 3.375 0 0 0-3.375-3.375H8.25m0 12.75h7.5m-7.5 3H12M10.5 2.25H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 0 0-9-9\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M12 9v3.75m0-10.036A11.96 11.96 0 0 1 3.598 6A12 12 0 0 0 3 9.75c0 5.592 3.824 10.29 9 11.622c5.176-1.332 9-6.03 9-11.622c0-1.31-.21-2.57-.598-3.75h-.152c-3.196 0-6.1-1.25-8.25-3.286m0 13.036h.008v.008H12z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M9 12.75L11.25 15L15 9.75m-3-7.036A11.96 11.96 0 0 1 3.598 6A12 12 0 0 0 3 9.749c0 5.592 3.824 10.29 9 11.623c5.176-1.332 9-6.03 9-11.622c0-1.31-.21-2.571-.598-3.751h-.152c-3.196 0-6.1-1.248-8.25-3.285\"\u002F>",{"id":37,"documentId":38,"title":39,"content":40,"slug":41,"published":42,"createdAt":43,"updatedAt":43,"publishedAt":44,"locale":45,"authorManual":46,"cover":47,"tags":98,"seo":123,"author":51},17,"clcdm05jrld7dd1wf5pxzlr0","Deploy YubiOn Portal in Amazon WorkSpaces Environment","\u003Cp>Updated: Feb 6, 2023\u003C\u002Fp>\n\u003Cp>About 8 months ago, I published an \u003Ca href=\"https:\u002F\u002Fwww.yubion.com\u002Fpost\u002Fdeploying-yubion-portal-in-the-citrix-virtual-apps-and-desktops-desktop-delivery-environment?lang=en\">article\u003C\u002Fa> about creating a Citrix desktop delivery environment in a lab environment and installing YubiOn Portal there. I haven't been able to experiment with this kind of virtual desktop environment for a while due to other development work. But this time, I had an opportunity to touch AWS WorkSpaces, so I would like to introduce YubiOn Portal there.\u003C\u002Fp>\n\u003Ch2>■ Configuration\u003C\u002Fh2>\n\u003Cp>As for the configuration, I think it can be said that it is a very general environment where you can say "I tried Amazon WorkSpaces".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_1_3f393ac145.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Last time, I built everything necessary for the lab environment, so you may have the impression that there were more things to do than the contents of the article. But cloud services are convenient in such cases. On the other hand, I'm also nervous that it might end up with a high bill. This time, I tried to do it for free as much as possible. But I will explain the story of the price at the end.\u003C\u002Fp>\n\u003Ch2>■ Build your WorkSpaces\u003C\u002Fh2>\n\u003Cp>If you just want to try out Amazon WorkSpaces, you should be able to make the necessary settings according to the instructions provided by AWS.\u003C\u002Fp>\n\u003Ch3>① Build a directory\u003C\u002Fh3>\n\u003Cp>First, create a "Directory" to place WorkSpaces. This is the part corresponding to Active Directory in Windows.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_2_5d603585ba.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>If it is just a trial, I think there is no problem with the "Simple AD" type. It seems that a compatible server called "Samba 4 Active Directory Compatible Server" is used instead of pure Microsoft AD.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fdirectoryservice\u002Flatest\u002Fadmin-guide\u002Fdirectory_simple_ad.html\">Simple Active Directory - AWS Directory Service (amazon.com)\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>"AWS Managed Microsoft AD" runs using pure Microsoft Windows Server 2019, so if you want to fully use the functions provided by Microsoft, you should use this.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fdirectoryservice\u002Flatest\u002Fadmin-guide\u002Fdirectory_microsoft_ad.html\">AWS Managed Microsoft AD - AWS Directory Service (amazon.com)\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>"AD Connector" is a bit different, and is an option for linking with AD in the existing intranet. I think that it will be used for purposes such as migrating things that were used locally in the company to the cloud.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fdirectoryservice\u002Flatest\u002Fadmin-guide\u002Fdirectory_ad_connector.html\">Active Directory Connector - AWS Directory Service (amazon.com)\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>Next, enter the directory information.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_3_d163bed8d1.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>It's a trial, so the size is small. Don't think too much about the organization name, DNS name, NetBIOS name, etc., end st them in the same way as a normal AD construction. If you forget the administrator password, you will not be able to manage it as AD, so please handle it strictly.\u003C\u002Fp>\n\u003Cp>Next, we will configure the network settings.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_4_10c3b4b8d3.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Here too, there is no problem if you follow the instructions on the screen to create a virtual network that uses WorkSpaces. However, if you create a subnet as a private subnet, and you just create a VPC and 2 subnets according to the instructions on this screen, you will not be able to access the Internet from that space. I will explain this later, so for now I will create a VPC and 2 private subnets and allocate them.\u003C\u002Fp>\n\u003Cp>(We will cut the public subnet later, so please leave room for additional subnets in the VPC.)\u003C\u002Fp>\n\u003Cp>After setting up here, check the contents on the "Review & create" screen and create the directory.\u003C\u002Fp>\n\u003Cp>As is often the case with AWS, after you click "Create", you have to wait for a while as it will be created in the background.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_5_175694c329.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>When the status becomes "Active", creation is complete. Finally, to use this directory with WorkSpaces, we need to "Register" it. (Select the directory → "Action" → "Register")\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_6_cf4f0e573f.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Specify the subnet you set earlier and register it.\u003C\u002Fp>\n\u003Ch3>② Create WorkSpaces\u003C\u002Fh3>\n\u003Cp>Next, we will create WorkSpaces. Although it is called "WorkSpaces", as far as the behavior is concerned, I think that one WorkSpace can be considered as one virtual machine. Not limited to this point, when using AWS, I think it is important to understand in your way what the specific terms of AWS refer to.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_7_ce63f29b47.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Create WorkSpaces with the "Create WorkSpaces" button on the above screen.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_8_be2cc854da.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Select the created directory and click "Next".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_9_718749c099.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>To create a new user, click "Create additional user" to move to the create screen. If you want to assign a user that already exists in the directory (such as deleting the previously created WorkSpaces and recreating it with the same user), you do not need to create a user here.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_10_0f631ed4f3.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Enter your user information. You can create up to 5 people, but here I set only 1 person and click "Next".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_11_cc027dca91.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Once the user has been created, you will automatically proceed to the "Identify Users" screen. This screen is a little confusing. It means that WorkSpaces will be created for the specified number of users, rather than allowing the specified user to log in to 1 newly created WorkSpace. Since I want to create only 1 this time, select only the user created earlier and click " Next".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_12_5e2a033e6d.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Then proceed to the step "Select Bundle". The "bundle" here is something like a template that is the base of WorkSpaces. The biggest difference is the OS, but there are other differences such as the presence or absence of Office and client protocol (communication protocol for actual remote operation).\u003C\u002Fp>\n\u003Cp>This time, select "Standard with Windows 10 (Server 2019 based)" with "WSP" as the client protocol. We will discuss the client protocol later.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_13_08d4db14a0.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Next, set the running mode, etc. As explained on the screen, the power is always on as a virtual machine (AlwaysOn), or it automatically stops when not in use (AutoStop). If it is for the experiment, I think that there is no problem with AutoStop. For tags, make settings as necessary.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_14_6e0aed7342.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Then there are the customization options. In actual operation, encryption should be properly performed, and the user volume should be selected appropriately according to the usage, but since it is an experiment, I will leave it as the default.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_15_9fc1bbbd05.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Finally, review the settings. If there seems to be no problem, click "Create WorkSpaces".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_16_4a1481edad.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Creating will start a background process as usual. It will take several tens of minutes to create these WorkSpaces, so please be patient. When creation is completed, an email saying "WorkSpaces for you has been created" will fly to the email address specified when creating an additional user.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_17_2dcb3eeb00.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>According to the contents of the email, set the user password, install the client application, and try to connect.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_18_440417c201.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_19_acc696862f.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>If you can connect to WorkSpaces as in the above image, first of all, I think that it is over to the point of "trying to run WorkSpaces".\u003C\u002Fp>\n\u003Ch2>■ Network settings\u003C\u002Fh2>\n\u003Cp>For now, I can access the virtual PC set up in WorkSpaces, but even \n if start the pre-installed Firefox on WorkSpaces, I can't connect to the Internet. Currently, the private part on the left side of the schematic diagram has been completed, and if you think about it in terms of a home LAN, it is in the stage of "I tried building a LAN in my house". So, next, we will create the public part on the right, which is the part that corresponds to the Internet connection router in the image of the home LAN.\u003C\u002Fp>\n\u003Cp>(A typical home internet router includes a LAN side gateway and DHCP server, so it's a little different from the image,...)\u003C\u002Fp>\n\u003Cp>Everything is created on the "VPC" screen of the AWS management console.\u003C\u002Fp>\n\u003Ch3>③ Create an Internet gateway and attach it to VPC\u003C\u002Fh3>\n\u003Cp>First, create an Internet gateway. There is nothing too difficult here, just choose a name and create it.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_20_4d6cafe6d7.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Once created, link it to an existing VPC. Select "Attach to a VPC" from the action menu to attach.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_21_9ba4d3a0d2.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_22_729ba5d8fd.png\" alt=\"\">\u003C\u002Fp>\n\u003Ch3>④ Create a public subnet\u003C\u002Fh3>\n\u003Cp>Create a subnet for access from the Internet side. Place the NAT gateway within this subnet. Public subnets are created in the same way as private subnets. Create by specifying an IPv4 CIDR block that is different from the existing private subnet within the range of your VPC.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_23_bbb4338b19.png\" alt=\"\">\u003C\u002Fp>\n\u003Ch3>⑤ Create a NAT gateway\u003C\u002Fh3>\n\u003Cp>From the NAT gateway management screen, click "Create NAT gateway" to display the creation screen. As the subnet, specify the public subnet created earlier, set the connectivity type to the public, and assign an Elastic IP.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_24_65a9c31eca.png\" alt=\"\">\u003C\u002Fp>\n\u003Ch3>⑥ Create a public route table\u003C\u002Fh3>\n\u003Cp>A set of virtual devices has been prepared, but as it stands, information about what route to take to get to the Internet is not set. Currently, I think that the same route table created by default is used for the 3 subnets, but it is necessary to specify different route information for the private side and the public side, so I will create 1 public route table. Select "Create route table" from the route table management screen.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_25_53d30cde6b.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Name it whatever you like and specify the VPC you're currently using.\u003C\u002Fp>\n\u003Ch3>⑦ Set route table association for the public subnet\u003C\u002Fh3>\n\u003Cp>Select the public subnet from the subnet management screen and open the "Route table" tab.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_26_5dd7cb3cc1.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Click "Edit rote table association", select the route table ID, set the public route table created earlier, and click "Save".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_27_f6aae1da80.png\" alt=\"\">\u003C\u002Fp>\n\u003Ch3>⑧ Configure routing for the public route table\u003C\u002Fh3>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_28_73fe95a923.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>From the route table management screen, select the created public route table, open the "Routes" tab, and click "Edit routes".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_29_85ac2faa6a.jpeg\" alt=\"\">\u003C\u002Fp>\n\u003Cp>By default, I think that the routing is set to go to local if it is within the VPC subnet range, but I will add a route that goes to the Internet gateway if it is "0.0.0.0\u002F0" and click "Save changes".\u003C\u002Fp>\n\u003Ch3>⑨ Set the routing of the private route table\u003C\u002Fh3>\n\u003Cp>As in the previous section, edit the default route table route associated with the private subnet.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_30_fc3fc8cd76.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Here, add a route that goes to the NAT gateway if it is "0.0.0.0\u002F0".\u003C\u002Fp>\n\u003Cp>With the settings up to this point, I think you will be able to access the Internet from WorkSpaces. Connect to your WorkSpaces again and try accessing the Internet with Firefox.\u003C\u002Fp>\n\u003Ch2>■ YubiOn Portal introduction and use in the logon section\u003C\u002Fh2>\n\u003Cp>Now I will install YubiOn Portal to the created WorkSpaces. Regarding the reuse of the main points when introducing Citrix products, the following points are almost common in virtual environments, especially in virtual environments with automatic logon to Windows.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Installation must be done for each WorkSpace.\u003C\u002Fstrong>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Currently, account and YubiKey assignments also need to be done for each WorkSpace.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Forced YubiKey logon must be enabled in the policy.\u003C\u002Fstrong>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>If not enabled, the WorkSpaces authentication mechanism will skip the Windows logon part.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Cache logon, screen lock when YubiKey is removed, etc. cannot be used.\u003C\u002Fstrong>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Both require YubiKey and USB communication, so they cannot be used in environments where USB is not directly connected.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>If you have multiple WorkSpaces, those machines must have different SIDs.\u003C\u002Fstrong>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>YubiOn Portal identifies each terminal based on SID and does not support situations where there are multiple terminals with the same SID.\u003C\u002Fp>\n\u003Cp>After completing the setup, access from the WorkSpaces client.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_31_4123396e82.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>After entering your WorkSpaces login information and signing in, the YubiOn Portal Windows logon screen will be displayed on the WorkSpaces screen.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_32_687faec987.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Here, you will be able to log on by entering your password + YubiKey. With WorkSpaces alone, the Windows logon part was omitted, but by introducing YubiOn Portal, it will be possible to enforce two-factor authentication when displaying the desktop.\u003C\u002Fp>\n\u003Ch2>■ Summary\u003C\u002Fh2>\n\u003Cp>The above is how to install YubiOn Portal for the Amazon WorkSpaces environment.\u003C\u002Fp>\n\u003Cp>As same as the previous introduction to Citrix products, I think there will be issues in terms of setup for large-scale use. Currently, I think that the method is to list the SIDs of the created WorkSpaces and install them using the kitting installation option, etc. However, we are looking for a way to automatically register from the created WorkSpaces with YubiOn Portal installed.\u003C\u002Fp>\n\u003Cp>There are 3 digressions below so I will write them together.\u003C\u002Fp>\n\u003Ch3>■ Digression ①: WorkSpaces client protocol\u003C\u002Fh3>\n\u003Cp>WorkSpaces has "PCoIP" and "WSP" as client protocols. Both are protocols for transferring input and output (video, audio, mouse operation, key input, etc.) of WorkSpaces terminals, but their origins are very different.\u003C\u002Fp>\n\u003Cp>① PCoIP (PC over IP)\u003C\u002Fp>\n\u003Cp>A protocol developed by Teradici Co. of Canada (acquired by HP Co. in 2021). In addition to Amazon WorkSpaces, it is also used by VMware's VMware Horizon.\u003C\u002Fp>\n\u003Cp>② WSP\u003C\u002Fp>\n\u003Cp>A protocol originally developed by Amazon, an abbreviation for "WorkSpaces Streaming Protocol".\u003C\u002Fp>\n\u003Cp>The comparison between the two is detailed in AWS help.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fworkspaces\u002Flatest\u002Fadminguide\u002Famazon-workspaces-protocols.html\">Protocols for Amazon WorkSpaces - Amazon WorkSpaces\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>The reason why WorkSpaces supports two protocols is speculation. At first, PCoIP was adopted, but to deal with an unstable network environment and support cameras, it was necessary to reconsider the protocol itself and develop a separate WSP. Assuming such circumstances, I think that WSP will become mainstream in WorkSpaces in the future.\u003C\u002Fp>\n\u003Cp>In this procedure, I used WSP, but YubiOn Portal itself works normally even if PCoIP is used. However, when using PCoIP, there is a problem after entering the authentication information in the WorkSpaces client, we have to wait about 1 minute until the Windows logon screen is displayed. Presumably, in the case of PCoIP connections, I suspect there is a mechanism to wait for Windows to log on properly (or time to) using the credentials sent by the WorkSpaces client.\u003C\u002Fp>\n\u003Ch3>■ Digression ②: How FIDO Logon works in WorkSpaces\u003C\u002Fh3>\n\u003Cp>It is related to digression ①. When using the PCoIP protocol, a mechanism called USB transfer can be used.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fworkspaces\u002Flatest\u002Fuserguide\u002Fusb-redirection.html\">WorkSpaces USB redirection - Amazon WorkSpaces\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>In addition to the contents of the above help, in the other to use it, it is necessary to set USB transfer permission in the AD group policy. (I will omit that part this time.)\u003C\u002Fp>\n\u003Cp>I also experimented to see if FIDO Logon can be used. In conclusion, it is possible. However, there are some problems, and I think that it is not practical at the moment.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>As the problem mentioned in digression ① (waiting for about 1 minute until connection) is the same for FIDO Logon.\u003C\u002Fli>\n\u003Cli>YubiKey is the only device officially supported by Amazon and the flexibility of key selection for FIDO2 authentication is lost.\u003C\u002Fli>\n\u003Cli>It seems to be dependent on the environment, but when I tried it, there was a phenomenon that the WorkSpaces client could not recognize the device after removing and reinserting the device or reconnecting to WorkSpaces. (including supposed YubiKeys)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Technically speaking, it may be quite difficult to transfer USB device communication, which is usually exchanged in milliseconds, over the Internet in 100 milliseconds. In addition, there is also the idea that the FIDO mechanism itself is a requirement from the security point of view that the related devices are in the hands of the user. None of the USB\u002FNFC\u002FBLE supported by FIDO2 are originally designed to send communications to remote locations. DaaS authentication, including the pros and cons of transferring USB devices, may be an issue that the industry should continue to consider in the future.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_33_45a5132c79.png\" alt=\"\">\u003C\u002Fp>\n\u003Ch3>■ Digression ③: Billing for AWS charges\u003C\u002Fh3>\n\u003Cp>The truth is that since it's just a trial, so if possible, I want to use it for free. However, the charges are as follows.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_34_b34baf3f0e.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>In the "Bundle" settings, I chose the item "Free tier eligible", so the "Software" portion is free. However, it seems that the operation of the instance and the user registration of the directory are not free. And, although it is not described in the above image, I think that parts other than WorkSpaces (such as VPC) are also charged.\u003C\u002Fp>\n","deploy-yubion-portal-in-amazon-workspaces","2022-12-27","2026-04-28T06:16:38.476Z","2026-04-28T06:16:41.441Z","en","YubiOnstaff",{"id":48,"documentId":49,"name":50,"alternativeText":51,"caption":51,"focalPoint":51,"width":52,"height":53,"formats":54,"hash":93,"ext":56,"mime":60,"size":94,"url":95,"previewUrl":51,"provider":96,"provider_metadata":51,"createdAt":97,"updatedAt":97,"publishedAt":97},328,"fkb9803t2ai8tcwz9f8yn9b0","blog-deploy-yubion-portal-in-amazon-workspaces-1.png",null,4180,2453,{"large":55,"small":66,"medium":75,"thumbnail":84},{"ext":56,"url":57,"etag":58,"hash":59,"mime":60,"name":61,"path":51,"size":62,"width":63,"height":64,"sizeInBytes":65},".png","https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Flarge_blog_deploy_yubion_portal_in_amazon_workspaces_1_3f393ac145.png","a3e29b0d92865c4ce786e06a4f1199f6","large_blog_deploy_yubion_portal_in_amazon_workspaces_1_3f393ac145","image\u002Fpng","large_blog-deploy-yubion-portal-in-amazon-workspaces-1.png",99.98,1000,587,99981,{"ext":56,"url":67,"etag":68,"hash":69,"mime":60,"name":70,"path":51,"size":71,"width":72,"height":73,"sizeInBytes":74},"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fsmall_blog_deploy_yubion_portal_in_amazon_workspaces_1_3f393ac145.png","73aa96676b546a80753286b807a384a2","small_blog_deploy_yubion_portal_in_amazon_workspaces_1_3f393ac145","small_blog-deploy-yubion-portal-in-amazon-workspaces-1.png",38.88,500,293,38877,{"ext":56,"url":76,"etag":77,"hash":78,"mime":60,"name":79,"path":51,"size":80,"width":81,"height":82,"sizeInBytes":83},"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fmedium_blog_deploy_yubion_portal_in_amazon_workspaces_1_3f393ac145.png","5b06cac1759ab7fdb67d3e7da0f21077","medium_blog_deploy_yubion_portal_in_amazon_workspaces_1_3f393ac145","medium_blog-deploy-yubion-portal-in-amazon-workspaces-1.png",65.19,750,440,65187,{"ext":56,"url":85,"etag":86,"hash":87,"mime":60,"name":88,"path":51,"size":89,"width":90,"height":91,"sizeInBytes":92},"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fthumbnail_blog_deploy_yubion_portal_in_amazon_workspaces_1_3f393ac145.png","e6ae459f8b60106ce39841dcb91c6c05","thumbnail_blog_deploy_yubion_portal_in_amazon_workspaces_1_3f393ac145","thumbnail_blog-deploy-yubion-portal-in-amazon-workspaces-1.png",14.95,245,144,14948,"blog_deploy_yubion_portal_in_amazon_workspaces_1_3f393ac145",250.81,"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_deploy_yubion_portal_in_amazon_workspaces_1_3f393ac145.png","aws-s3","2026-04-28T06:13:42.500Z",[99,105,111,117],{"id":100,"documentId":101,"name":102,"slug":51,"createdAt":103,"updatedAt":103,"publishedAt":104},20,"hww1z9wzs2ue2bz8z8aslu0x","YubiOnPortal","2026-04-28T04:15:58.811Z","2026-04-28T04:16:00.686Z",{"id":106,"documentId":107,"name":108,"slug":51,"createdAt":109,"updatedAt":109,"publishedAt":110},90,"n9u5mo7asrxetrc7s5uptn6z","AWS","2026-04-28T06:16:19.352Z","2026-04-28T06:16:21.281Z",{"id":112,"documentId":113,"name":114,"slug":51,"createdAt":115,"updatedAt":115,"publishedAt":116},92,"iyvx8lyirvmfur5dbvk7w5e8","AWSWorkSpaces","2026-04-28T06:16:26.772Z","2026-04-28T06:16:28.643Z",{"id":118,"documentId":119,"name":120,"slug":51,"createdAt":121,"updatedAt":121,"publishedAt":122},94,"joorjtxv4v5db878nos2772i","VirtualMachine","2026-04-28T06:16:33.917Z","2026-04-28T06:16:35.731Z",{"id":124,"metaDescription":125},251,"Learn how to easily deploy YubiOn Portal in an Amazon WorkSpaces environment for enhanced virtual desktop security.",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":127},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M15.75 6a3.75 3.75 0 1 1-7.5 0a3.75 3.75 0 0 1 7.5 0M4.501 20.118a7.5 7.5 0 0 1 14.998 0A17.9 17.9 0 0 1 12 21.75c-2.676 0-5.216-.584-7.499-1.632\"\u002F>",1783406261266]