Multi-Factor Authentication in Amazon WorkSpaces

(Update) On the topic of Multi-Factor Authentication, we recommend two new courses we’ve released Understanding of AWS Authentication, Authorization & Accounting and Implementing Multi-Factor Authentication on Azure. 


Just a few days ago we talked about how to protect your AWS based server with Multi-Factor Authentication.

This not-so-new technology is spreading more and more, especially given that it hugely increases security at the very tiny inconvenience of entering a One-Time-Password every time you log in to your system.  The OTP can be generated either by a physical or a virtual device, like for example a smartphone app. This is extremely convenient, especially considered that we always (or almost always) have our smartphone around, and even if someone stoles it, the thief still hasn’t all the pieces needed to log into our account. So, we all like MFA, and we like it so much that Amazon added support for Multi-Factor Authentication in Amazon WorkSpaces, one if the services of its AWS family. Even better: it’s available for free!
Amazon WorkSpaces Logo

What is Amazon WorkSpaces?

We don’t talk about WorkSpaces that often on this blog. Actually, it’s definitely not a first-tier service of AWS. Nevertheless, it’s having quite a success and has many interesting applications, so it’s still good to learn more about it.
Amazon describes WorkSpaces as a “fully managed desktop computing service in the cloud“. In other words, WorkSpaces allows you to launch cloud-based Windows desktop instances that users can access from their own device, including mobile devices like iPad, Android tablets, and of course Amazon’s Kindle Fire. End users will have a complete Windows 7 based desktop interface, easing all the burden of installing device drivers or setting up applications. As it happens with many SaaS solutions (or maybe we should call it an “Operating System as a Service”?), the price for this convenience is a loss of flexibility at a certain degree. Anyway, WorkSpaces still is a viable solution, with a high-security level granted by the adoption of the PCoIP protocol, and with lower costs than other on-premises Virtual Desktop Infrastructure.

How to enable MFA in Amazon WorkSpaces

Amazon added support for MFA using an on-premises RADIUS server, meaning that users will be able to authenticate themselves using the same mechanism that they already use for other remote access systems of their organization. So, after MFA has been enabled and configured, WorkSpaces users will just log in by entering their usual Active Directory user name and password, and then the One-Time Password supplied by either a hardware or a virtual device, just like the smartphone application we discussed earlier.

The new WorkSpaces feature works with any security provider supporting RADIUS. Amazon added support for many protocols, including PAP, CHAP, MS-CHAP1, and MS-CHAP2, which should be enough to grant compatibility with the vast majority of the existing infrastructures. To actually enable MFA, the WorkSpaces administrator must configure the new feature by entering the connection information for the on-premises RADIUS server in the Directories section of the WorkSpaces console. If high availability is a concern, it’s possible to provide multiple RADIUS servers, either adding all their IP addresses or deploying an Elastic Load Balancer in front of them.

Cloud Academy