Lecture 259: AWS Network architecture for Amazon WorkSpaces/Appstream 2.0
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:48
- 来源：Udemy Lecture 33790106
- Slide 数量：4
- 画面切换：01:41、03:29、05:31
扫描说明
逐条读取了 Transcript 面板中的 179 条英文 cue，并按播放器进度同步全长约 7:48 的视频。依据 Requester-managed ENI/Service Model、AWS-managed vs Customer VPC、Customer-side ENI/Directory Connectivity 与 Authentication/Streaming/Application Flow 划分为 4 个小节。4 张截图来自真实课程 Slide，统一为 1364×770。课程用 WorkSpaces 的 PCoIP 4172 端口作示例；Streaming Protocol、Port 与 Endpoint 选项会随 WorkSpaces/AppStream 客户端和功能演进，讲义只保留三类流量与路由边界，并提示查当前 Network Requirements。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. AWS-managed Compute 通过 Requester-managed ENI 接入 Customer VPC
时间范围：00:00–01:41
总结 / Summary
中文
Amazon WorkSpaces 提供 Managed Desktop，Amazon AppStream 2.0 提供 Managed Application Streaming。Compute/Management Plane 运行在 AWS 管理的网络中，但要访问客户的 AD、Database、File Share、S3 Endpoint 或 On-premises Application，服务会在客户选择的 Subnet 创建 Requester-managed ENI。ENI 出现在客户 Account/VPC 中并消耗 Private IP，可关联 Security Group；其 Lifecycle 由 AWS Service 管理，用户不应手工 Detach/Delete。这个模式也见于 RDS、Directory Service、Load Balancer 等托管服务。
English
Amazon WorkSpaces provides managed desktops, while Amazon AppStream 2.0 provides managed application streaming. Compute and management planes run in AWS-managed networks, but access to customer Active Directory, databases, file shares, S3 endpoints, or on-premises applications uses requester-managed ENIs created in customer-selected subnets. The ENIs appear in the customer account and VPC, consume private addresses, and can use security groups, while their lifecycle is controlled by the AWS service and they should not be manually detached or deleted. The same pattern appears in RDS, Directory Service, load balancers, and other managed services.
Transcript
00:00 Hello, and welcome to this lecture.
00:02 VPC resource access for Amazon WorkSpaces and AppStream 2.0.
00:07 And the reason for this lecture is really to understand
00:10 how AWS manages the network access for the services,
00:15 which are managed by AWS.
00:18 Now you already know about requester-managed ENIs.
00:21 We touched upon that earlier,
00:23 where if you're launching, say RDS database,
00:27 then database is really managed by AWS,
00:29 but still the network is being controlled by customer.
00:34 So customer can have
00:35 the security group attached to the database.
00:38 Now you don't have the database control,
00:40 but then you can still manage the network for that database.
00:44 Now, similar thing happens for AWS managed services,
00:48 like Amazon WorkSpaces and AppStream.
00:50 And let's see how it works.
00:51 Those who does not know
00:53 about Amazon WorkSpaces and AppStream,
00:56 these are the end user computing services by AWS.
00:59 Amazon WorkSpaces is a desktop as a service.
01:02 So it's a remote desktop.
01:03 Now, similarly AppStream is application as a service.
01:07 So instead of giving access to the full desktop,
01:11 a company may want to give access to application.
01:14 So user doesn't really get a complete desktop view,
01:18 but then user can launch remotely all those application,
01:21 which user is supposed to access
01:24 for, you know, performing his or her work.
01:27 So that's an AppStream service.
01:30 We don't need to really get
01:31 into the details of these services,
01:33 but let's look at how the network looks like
01:36 when you launched a workspace instance
01:38 or AppStream 2.0 instance.
2. 架构包含 User Edge、AWS-managed Service Network、Customer VPC 与 Corporate Network
时间范围：01:41–03:29
总结 / Summary
中文
典型 Hybrid End-user Computing 架构有四个边界：用户从 Office/Home 连接 AWS Service Edge；WorkSpaces/AppStream Session/Streaming Component 位于 AWS-managed Network；Customer VPC 提供 ENI、Subnet、SG、Route、DNS 与 Application Access；Corporate Network 放置 AD、MFA/RADIUS、File Server 等，并通过 Site-to-Site VPN、Direct Connect/TGW 连接 Customer VPC。不要把“用户到 Streaming Gateway 的路径”和“Desktop/Application 到业务资源的路径”混成同一条 Internet 流量；两者经过不同 Interface 与 Security Control。
English
A typical hybrid end-user-computing architecture has four boundaries: users connect from office or home to the AWS service edge; WorkSpaces or AppStream session and streaming components run in an AWS-managed network; the customer VPC provides ENIs, subnets, security groups, routes, DNS, and application access; and the corporate network hosts Active Directory, MFA or RADIUS, file servers, and other services connected through Site-to-Site VPN, Direct Connect, or Transit Gateway. Do not combine the user's path to the streaming gateway with the desktop or application's path to business resources; they use different interfaces and security controls.
Transcript
01:41 So there is AWS account,
01:44 and then you have on-premises account.
01:47 Now many a times while using AWS WorkSpaces and AppStream,
01:50 you would still want your users
01:52 to log in with your on-premises AD credentials.
01:55 And that means AWS networks should be connected
01:58 to the corporate network securely.
02:00 And then your AD server, which is hosted on-premises,
02:04 should be able to authenticate those users.
02:07 Now, in case of bring your own device kind of thing,
02:10 user may work from home or from the office,
02:13 but then user can connect to this instances
02:16 over the internet.
02:17 So there is also internet in the picture.
02:20 Now for this services,
02:22 you will launch AWS WorkSpaces or AppStream
02:24 in AWS managed VPC.
02:27 So you don't really create this VPC.
02:29 It is completely managed by AWS.
02:31 So you just launch the workspace instances,
02:34 and these instances get created into this VPC.
02:38 But then you also have your own VPC,
02:40 which we call customer VPC,
02:42 in which you would have your different applications,
02:45 maybe you would have access
02:47 to the optimized data center through VPN or a DX,
02:51 or you would have VPC endpoints
02:53 created to access S3 and other services,
02:56 or maybe databases.
02:57 This is a typical VPC that you have
03:00 where you have your workloads running,
03:01 some EC2 machines, some web servers.
03:04 And then you have these Amazon WorkSpaces instances
03:07 in AWS managed VPC.
03:09 So now how your workspace instances
03:11 can really access your resources,
03:15 which are inside your VPC?
03:17 That's really the question is.
03:19 If AWS is managing everything for you,
03:21 then how does AWS services can access
03:24 your VPC resources privately
03:26 without you exposing it to the internet?
3. Service-side Interface 承担 Management/Streaming，Customer-side ENI 承担 Application/Directory Traffic
时间范围：03:29–05:31
总结 / Summary
中文
WorkSpaces 的网络模型可理解为两侧 Interface：AWS 管理的一侧用于 Service Management/Streaming，客户 VPC 中的 Primary ENI 用于访问 Application Resource；AppStream Fleet Instance 也通过客户 Subnet ENI 访问 VPC Resource。客户必须为每个 Session/Desktop 预留足够 Subnet IP，并配置 SG/NACL/Route/DNS。若使用 On-premises AD，AD Connector 是 Directory Proxy，不存储用户；它通过客户 VPC 的 VPN/DX 路径把 Authentication 请求转发给现有 AD。AD/DNS/MFA 所需 Port、Return Route 与 MTU 都要端到端验证。
English
The WorkSpaces network model can be understood as two interface domains: the AWS-managed side handles service management and streaming, while the primary ENI in the customer VPC accesses application resources. AppStream fleet instances likewise use customer-subnet ENIs for VPC access. Customers must reserve sufficient subnet addresses per desktop or session and configure security groups, NACLs, routes, and DNS. When using on-premises Active Directory, AD Connector acts as a directory proxy rather than storing users and forwards authentication through the customer VPC's VPN or Direct Connect path. Validate required AD, DNS, and MFA ports, return routes, and MTU end to end.
Transcript
03:29 And for that, what AWS does it,
03:32 it creates ENIs, elastic network interface,
03:36 on behalf of these workspace instances.
03:39 So your workspace instance would have two ENIs.
03:41 One, which is provisioned inside your VPC,
03:44 which AWS will automatically create,
03:47 and it will ask you which subnet this ENIs to be created.
03:51 You feel like your workspace instance
03:53 is getting created into your subnet,
03:55 but it is just ENI which gets created.
03:58 And similarly, there is one more ENI for your workspace,
04:01 which basically is used to stream your workspace instances
04:06 to your end user over the internet.
04:08 Now, what I'm talking is all about WorkSpaces.
04:11 So you might have to go and read
04:13 what WorkSpaces is and what the streaming means.
04:16 But more importantly, we are interested in these ENIs,
04:19 which AWS creates on behalf of the workspace
04:22 into your VPC and into your subnets.
04:26 Now, particularly for WorkSpaces,
04:28 you have to authenticate users using the Active Directory
04:31 and then once users are authenticated,
04:34 the desktop is stream over the internet.
04:37 And these ENIs are also created for this streaming gateway.
04:41 So every workspace would have at least these two ENIs,
04:44 one for streaming gateway
04:45 and one for your subnets or your VPC.
04:50 Now for authentication,
04:51 you could use AD connector,
04:52 because Active Directory is on-premises.
04:55 And this is just one kind of example.
04:57 You could very well have your
04:58 Active Directory hosted in the cloud,
05:01 and then you don't have any connection
05:03 with your corporate data center.
05:04 But this is just one way
05:07 where you could have a hybrid network setup
05:09 between these two networks.
05:11 And this network could be over a VPN or a DX,
05:13 doesn't really matter.
05:15 What this means is
05:16 your VPC can access your on-premise resources.
05:19 And that's why your workspace could
05:22 also access this on-premise resources via this route,
05:25 because it has ENI here.
05:27 It can use your VPN or DX connection
05:29 to reach to on-premise server.
4. 分开排查 Authentication、Streaming 与 Application Data 三条 Flow
时间范围：05:31–07:48
总结 / Summary
中文
Authentication Flow：Client 连接 Auth/Session Endpoint，Directory/AD Connector 再通过 VPC 与 VPN/DX 联系 AD/MFA。Streaming Flow：认证后 Client 与 AWS Streaming Gateway/WorkSpace 建立 PCoIP、WSP 或 AppStream Streaming Session；具体 TCP/UDP Port 与 Fallback 依客户端、协议、Endpoint/Internet 设计而变，应查当前文档。Application Data Flow：桌面/应用通过 Customer-side ENI 按 VPC Route/SG/NACL/DNS 访问 EC2、RDS、S3 Endpoint 或 On-premises。登录失败先查 Directory/DNS，黑屏/延迟查 Streaming Path，应用不可达查 Customer ENI 与 VPC/Hybrid Routing。
English
Authentication flow: the client reaches the authentication or session endpoint, and the directory or AD Connector reaches Active Directory and MFA through the VPC and VPN or Direct Connect. Streaming flow: after authentication, the client establishes a PCoIP, WSP, or AppStream session through AWS streaming gateways; exact TCP and UDP ports and fallback behavior depend on the client, protocol, and endpoint or internet design, so use current documentation. Application-data flow: the desktop or application uses its customer-side ENI and VPC routes, security groups, NACLs, and DNS to reach EC2, RDS, S3 endpoints, or on-premises systems. Troubleshoot login failures in directory and DNS, black screens or latency in the streaming path, and application reachability in the customer ENI and VPC or hybrid path.
Transcript
05:31 So now, if you look at the flow of the traffic, right,
05:35 then end user will first authenticate himself or herself
05:40 using the auth/session gateway.
05:42 Now these are the public endpoints
05:43 that AWS creates for WorkSpaces, right?
05:46 And you don't have to worry about that,
05:48 because it is in AWS managed VPC,
05:51 but they're always accessible over the internet.
05:54 Now, once that is turned,
05:56 this auth/session gateway can then go to AD connector,
05:59 which is part of your VPC now.
06:02 And then from there,
06:04 it reaches through VPN or DX to your corporate data center,
06:09 and user gets authenticated.
06:11 Now, once user is authenticated, that flow is complete,
06:14 and now user will use those authentication token
06:18 or whatever mechanism is there, like a SAML,
06:19 it'll use that token
06:22 to now reach to the streaming gateway
06:24 with whatever protocol WorkSpaces support.
06:27 It supports 4172 port or TCP or UDP
06:31 called PCoIP protocol,
06:33 but there is a newer protocol as well.
06:35 But that's not of our interest.
06:37 So once user is authenticated,
06:39 user then start the streaming of the data.
06:41 Now this streaming gateway
06:43 has an ENI attached to the WorkSpaces,
06:45 so ultimately, what is running in the workspace
06:48 can be streamed over this streaming gateway.
06:50 And from there,
06:52 the request will go to either of the workspace instance,
06:54 whichever has been allocated to a user.
06:57 And now from the WorkSpaces,
06:59 so it's like a desktop,
07:00 if you are using or connecting to your database,
07:04 then this ENI will be used
07:06 to, you know, access those resources.
07:08 So whether it's a database, other EC2 instance,
07:11 or connection to your on-premise data center,
07:14 all that happens through this ENI,
07:17 which means your workspace instance
07:20 can now access your VPC resources.
07:23 So in general,
07:24 that's what the networking looks like
07:27 when you use Amazon managed services,
07:29 like WorkSpaces or AppStream.
07:31 And I hope that is clear.
07:33 So just remember that, you know,
07:35 AWS does create this kind of ENIs into your VPC
07:39 to access your VPC resources.
07:42 So that's it for this lecture.
07:43 Hope this is clear.
07:45 And let's move on.
07:47 Thanks for watching.
整讲总结 / Overall Summary
中文
WorkSpaces/AppStream 网络题的关键不是背单一端口，而是识别 AWS-managed Service Plane 与 Customer VPC Data Plane 之间的 Requester-managed ENI，并把 Authentication、Streaming、Application Data 三条路径分开。ENI 消耗客户 Subnet IP，受 SG/Route/NACL/DNS 控制；On-premises AD 还要求 VPN/DX 双向路由与端口完整。
English
The key to WorkSpaces and AppStream networking questions is not memorizing one port, but identifying the requester-managed ENI between the AWS-managed service plane and the customer VPC data plane, then separating authentication, streaming, and application-data paths. The ENI consumes customer-subnet addresses and follows security groups, routes, NACLs, and DNS; on-premises Active Directory also requires complete bidirectional VPN or Direct Connect routing and ports.
返回顶部 ↑