Applicable Products
- XenDesktop 7.8
- XenDesktop 7.9
- XenDesktop 7.7
- XenDesktop 7.5
- XenDesktop 7.6
Objective
This article explains how the Amazon Identity and Access Management (IAM) service can be used to define a precise set of permissions for using XenDesktop within an Amazon Web Services (AWS) deployment.
Requirements
You will require an active AWS account, with sufficient privileges for creating new IAM users. This procedure can be followed entirely from within the AWS web console.
Background
Amazon’s IAM service allows for accounts having multiple users, which can also be organized into groups. These users can be given different permissions in order to control their ability to perform operations within the account. It is usually desirable to restrict users such that they are granted only the permissions required to fulfil their role. This article enumerates the precise set of permissions required for users who will need to operate XenDesktop sites within AWS.
Instructions
The following procedure is an example of how the correct permissions policy can be applied to a new group of users:
Log into the AWS web console and select the IAM service from the drop-down list at the upper left.
Select Create a New Group of Users.
Type a name for the new user group and select Continue.
On the Permissions page, choose Custom Policy and click Select.
Type a name for the Permissions policy.
In the Policy Document section, paste the following example policy text:
Click Continue to complete creating the group of users. (It is possible to add existing users to this group if required).
Users in the group will now be granted permissions to perform only those actions that are required for XenDesktop.
Aws Citrix Xendesktop
Additional Resources
The policy document in the preceding section is for example purposes only. Its intent is to list the actions that a XenDesktop site needs to perform within an AWS account, but without restricting those actions to specific resources. The example can be used for testing purposes. For production environments, it might be desirable to also add further restrictions on resources. For more information on how to do this, refer to the following AWS documentation links: