Workspaces deployment in multi account - Control Tower

0

I am helping a customer with their Workspaces deployment. The customer has AWS Control Tower, with an account for networking (where AD will be deployed) and one for Workspaces. I am running through the setup now and I can’t seem to get AD to register.

I created 4 subnets (2 private, 2 public) in the Workspaces account which I shared (using RAM) to the Network account. I set up managed AD on the Network account and selected the 2 private subnets that were shared from the Workspace account ( each subnet is in different AZ). I also shared managed AD with the Workspace account and set VPC peering.

The last step prior to deploying Workspaces is to Register the AD directory, which requires two subnets in different AZs. When attempting to do so, the only subnets displayed on the register window are a private and public subnet which are in the same AZ.

Additionally, when I attempt to launch a Workspace in the Workspace account it does not recognize the shared AD, instead it prompts to create a new directory.

Questions: Are there any concerns with the architecture approach I have taken so far? How do I bypass/fix the issue I am facing with Registration of AD? I checked that the shared VPC has all 4 subnets (a private and public in one az, and another set of private and public subnet in a separate AZ).

AWS
已提問 4 年前檢視次數 398 次
1 個回答
0
已接受的答案

Are there any concerns with the architecture approach I have taken so far?

You cannot use WorkSpaces with Shared VPC, Shared Managed AD.

How do I bypass/fix the issue I am facing with Registration of AD?

In order to make this work for your setup, you need to setup AD Connector for WorkSpaces. This will require you to enable traffic routing to the AWS Account/VPC where the Managed AD is deployed. You can achieve this with VPC Peering or Transit Gateway.

When attempting to do so, the only subnets displayed on the register window are a private and public subnet which are in the same AZ.

Amazon WorkSpaces is not supported in all available AZ in certain regions. In US-EAST-1, the only AZ that is supported by Amazon WorkSpaces are use1-az2, use1-az4, and use1-az6. You can find this AZ mapping in RAM for the account.

profile pictureAWS
專家
Dzung_N
已回答 4 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南