Unlocking Secure Web Access with Amazon WorkSpaces Secure Browser
Tags: aws, workspaces, enduser, community
Published: 2024-06-19 05:23:06

 

## Amazon Workspaces Secure Browser
 
Amazon Workspaces Secure Browser offers a secure environment for users to access private websites, SaaS applications, and the public internet. It operates within the user’s local browser, streaming encrypted pixels from a remote session hosted in the highly secure AWS cloud. Starting at just $7 per month, it eliminates the need for managing specialized client software, infrastructure, and VPN connections.

This service is particularly beneficial for organizations implementing Bring-Your-Own-Device (BYOD) policies, as it ensures sensitive web content never directly touches the end user’s device while providing cost-effective, secure access. Additionally, it’s ideal for scenarios like customer support, analytics environments, and safe browsing for high-security networks

## End User Experience 
The login page for Amazon WorkSpaces Secure Browser is seamlessly integrated with the user’s identity provider (idP). When users click ‘Sign In,’ they are redirected to their respective idP provider’s page (e.g., Entra login page). After successful authentication, users are redirected back to the Secure Browser page, where the application is initiated.

 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0qku4hrys9wbuyehzx5z.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jm8lgwtlzr7h4qcj3tg9.png)
 
As depicted in the screenshot below, we securely publish an intranet site using Amazon WorkSpaces Secure Browser. Within this environment, you can enforce controls such as disabling clipboard functionality and file transfers. By default, internet access is restricted for Secure Browser instances. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1k9e4eyeytn3z7g8s4z9.png)


## Configuring WorkSpaces Secure Browser
In the AWS Console, navigate to WorkSpaces secure browser. In the Secure Browser home page, click on “create portal” to initiate the creation of new Workspaces Secure Browser.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/opm37cd12kl4ughgujd3.png)


 
 In the “Specify networking connection” page, select your VPC, private subnets and security group where the micro instances will get spin up to handle the workspaces browser and Click next.

 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o00vdx7lj4nsa65xwabb.png)


 
In the “Configure portal settings” page, select the Display name of the portal, instance type and the maximum concurrent users/instance.
 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ybu760j5m146th13tjx0.png)


 The user access logging is captured into a kinesis data stream. Make sure you create the Kinesis data stream with the naming convention “amazon-workspaces-web-*” and also the server authentication is disabled.
The below screenshot shows the Kinesis data stream created for storing the user access logging details.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aup5kbsas56o245exlnz.png)


 
You can also enable IP access control to ensure that the users from a particular network is only allowed to access the browser.
 
 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/na5fkos39fyw912lj9p6.png)

 The policy settings allow you to configure your browser startup page, URL filtering to allow and deny specific URLs and also to configure pre-build browser bookmarks.
 
 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nvcytclwoup4uymg58c0.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/puo9e9m35ajg39utig3h.png)



The “select user settings" page allows the administrator to configure clipboard permissions, file transfer permissions and also session timeout settings.
 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iofhqlm9e7ntaklnbr5r.png)


 
 The “configure identity provider” settings allow administrators to integrate the secure browser via idp providers like Entra, OKTA etc.
In this blog post, I used Microsoft Entra for authentication purposes.

Select the radio button next to the “Standard (external IdP) and click on “Continue with standard IdP.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6ks8jx3z4kab06462l5j.png)
 
Download the SP metadata file which we will be importing to our enterprise application in Entra.
 ![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mtphehf6xl4g3wala0ur.png)
 
To configure the enterprise application, login to Azure portal and navigate to Entra ID.
Under Enterprise applications, select “+ new application”.

 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x0wshy9vp5zrbnjczbis.png)


 
In the Browse Microsoft Entra Gallery page, select "+ Create your own application”.
 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dh59hleiwh2gqvwlijr1.png)


 
 
In the “Create your own application” page, select the name of the application and select the radio button next to “Integrate any other application you don’t find in the gallery” and Click Finish.
 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q77qbvrl5lnmk4pt5ki4.png)


 
Go to the newly created enterprise application and click on Single sign on.
 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bowchxloons3qa1tb3bx.png)

 In the single sign on method, select SAML option.
 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p3lht6cug3kkxhtigv0w.png)

In the SAML based sign-on page, click on “upload metadata file, and select the SP metadata file we downloaded from the aws console.
 
 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3baq5p3m2vtzg3posan0.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gwup5zdskvx0yblz6im1.png)

After successfully uploading the metadata file, the App federation metadata URL will get generated. Go back to the Workspaces IdP configuration page and click on the radio button next to “Enter metadata endpoint URL” and provide the URL copied from Entra App page.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/luhnkbl4kfc7g8pmuapa.png)

In the “Review and launch” page, verify the configuration and click on finish to launch the secure browser.
 
 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zijropxh5dgcpaynd9hg.png)


The portal page looks like below and the status will become Active.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vssq4oggfl8qvh53iytc.png)

## Monitoring the Secure Browser.
CloudWatch metrics can be utilized to monitor Amazon Workspaces Secure Browser. These metrics are defined under ‘WorkSpacesWeb’ and include five default portal metrics.
 
1. Session Attempt

1. Session success

1. Session failure

1. Global memory percentage

1. global Cpu percentage 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sqa893u9thg9sy593ot4.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8d836r50etfu1gv9j2ic.png)
 
The kinesis data streams metrics can be also monitored using Cloudwatch.

 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i10uxjd64uio0ct67pm9.png)


## Auditing the WorkSpaces Secure Browser Admin activities
CloudTrail can be used to monitor the admin activities related to the Secure browser

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n07935bvjeeccddihhbg.png)

The End User access logging can be monitored via Kinesis data stream logs.

The WorkSpaces secure browser is a good option for remote workers who only leverages Web/SaaS Applications as part of the day to day activities.

Hope this blog helps you to understand how secure browser can be configured in a real scenario.