2026/11/13 - Amazon AppStream - 1 new8 updated api methods
Changes Amazon WorkSpaces Agent Access now supports image builders, so AI agents can install, configure, and test applications before you create an image. New Replay Session delivers a video of screenshots, a transcript, and a report for each agent session, optionally encrypted with your own KMS key.
Updates the specified fields for the specified image builder. The image builder must be in the STOPPED state.
See also: AWS API Documentation
Request Syntax
client.update_image_builder(
Name='string',
Description='string',
DisplayName='string',
AgentAccessConfig={
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
},
AttributesToDelete=[
'AGENT_ACCESS_CONFIG',
]
)
string
[REQUIRED]
The name of the image builder.
string
The description to display.
string
The image builder name to display.
dict
The configuration for agent access on the image builder. Specify this to update agent access settings. To remove agent access, use AttributesToDelete with the AGENT_ACCESS_CONFIG value.
Settings (list) --
The list of agent access settings that define permissions for each agent action. These settings are merged with the stored settings by agent action. A setting that you specify replaces the stored setting for the same agent action. The merged settings must have at least one agent action enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) -- [REQUIRED]
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) -- [REQUIRED]
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots are stored. If ScreenshotsUploadEnabled is false after the merge, the stored bucket ARN is removed.
ScreenshotsUploadEnabled (boolean) --
Specifies whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ScreenResolution (string) --
The screen resolution for the agent streaming environment.
W_1280xH_720 - 1280 x 720 pixels.
ScreenImageFormat (string) --
The image format for agent screen captures.
PNG - PNG format.
JPEG - JPEG format.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
VIEW_ONLY - Users can view and observe agent actions as they happen.
VIEW_STOP - Users can view agent actions and stop the agent if needed.
DISABLED - Users cannot view or stop the agent session.
list
The image builder attributes to delete.
(string) --
An image builder attribute that you can delete by using the AttributesToDelete parameter of UpdateImageBuilder.
AGENT_ACCESS_CONFIG - Removes the stored agent access configuration from the image builder.
dict
Response Syntax
{
'ImageBuilder': {
'Name': 'string',
'Arn': 'string',
'ImageArn': 'string',
'Description': 'string',
'DisplayName': 'string',
'VpcConfig': {
'SubnetIds': [
'string',
],
'SecurityGroupIds': [
'string',
]
},
'InstanceType': 'string',
'Platform': 'WINDOWS'|'WINDOWS_SERVER_2016'|'WINDOWS_SERVER_2019'|'WINDOWS_SERVER_2022'|'WINDOWS_SERVER_2025'|'WINDOWS_11'|'AMAZON_LINUX2'|'RHEL8'|'ROCKY_LINUX8'|'UBUNTU_PRO_2404',
'IamRoleArn': 'string',
'State': 'PENDING'|'UPDATING_AGENT'|'RUNNING'|'STOPPING'|'STOPPED'|'REBOOTING'|'SNAPSHOTTING'|'DELETING'|'FAILED'|'UPDATING'|'PENDING_QUALIFICATION'|'PENDING_SYNCING_APPS'|'SYNCING_APPS'|'PENDING_IMAGE_IMPORT',
'StateChangeReason': {
'Code': 'INTERNAL_ERROR'|'IMAGE_UNAVAILABLE',
'Message': 'string'
},
'CreatedTime': datetime(2015, 1, 1),
'EnableDefaultInternetAccess': True|False,
'DomainJoinInfo': {
'DirectoryName': 'string',
'OrganizationalUnitDistinguishedName': 'string'
},
'NetworkAccessConfiguration': {
'EniPrivateIpAddress': 'string',
'EniIpv6Addresses': [
'string',
],
'EniId': 'string'
},
'ImageBuilderErrors': [
{
'ErrorCode': 'IAM_SERVICE_ROLE_MISSING_ENI_DESCRIBE_ACTION'|'IAM_SERVICE_ROLE_MISSING_ENI_CREATE_ACTION'|'IAM_SERVICE_ROLE_MISSING_ENI_DELETE_ACTION'|'NETWORK_INTERFACE_LIMIT_EXCEEDED'|'INTERNAL_SERVICE_ERROR'|'IAM_SERVICE_ROLE_IS_MISSING'|'MACHINE_ROLE_IS_MISSING'|'STS_DISABLED_IN_REGION'|'SUBNET_HAS_INSUFFICIENT_IP_ADDRESSES'|'IAM_SERVICE_ROLE_MISSING_DESCRIBE_SUBNET_ACTION'|'SUBNET_NOT_FOUND'|'IMAGE_NOT_FOUND'|'INVALID_SUBNET_CONFIGURATION'|'SECURITY_GROUPS_NOT_FOUND'|'IGW_NOT_ATTACHED'|'IAM_SERVICE_ROLE_MISSING_DESCRIBE_SECURITY_GROUPS_ACTION'|'FLEET_STOPPED'|'FLEET_INSTANCE_PROVISIONING_FAILURE'|'DOMAIN_JOIN_ERROR_FILE_NOT_FOUND'|'DOMAIN_JOIN_ERROR_ACCESS_DENIED'|'DOMAIN_JOIN_ERROR_LOGON_FAILURE'|'DOMAIN_JOIN_ERROR_INVALID_PARAMETER'|'DOMAIN_JOIN_ERROR_MORE_DATA'|'DOMAIN_JOIN_ERROR_NO_SUCH_DOMAIN'|'DOMAIN_JOIN_ERROR_NOT_SUPPORTED'|'DOMAIN_JOIN_NERR_INVALID_WORKGROUP_NAME'|'DOMAIN_JOIN_NERR_WORKSTATION_NOT_STARTED'|'DOMAIN_JOIN_ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED'|'DOMAIN_JOIN_NERR_PASSWORD_EXPIRED'|'DOMAIN_JOIN_INTERNAL_SERVICE_ERROR'|'VALIDATION_ERROR',
'ErrorMessage': 'string',
'ErrorTimestamp': datetime(2015, 1, 1)
},
],
'AppstreamAgentVersion': 'string',
'AccessEndpoints': [
{
'EndpointType': 'STREAMING',
'VpceId': 'string'
},
],
'RootVolumeConfig': {
'VolumeSizeInGb': 123
},
'LatestAppstreamAgentVersion': 'TRUE'|'FALSE',
'DisableIMDSV1': True|False,
'AgentAccessConfig': {
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
}
}
}
Response Structure
(dict) --
ImageBuilder (dict) --
Information about the image builder.
Name (string) --
The name of the image builder.
Arn (string) --
The ARN for the image builder.
ImageArn (string) --
The ARN of the image from which this builder was created.
Description (string) --
The description to display.
DisplayName (string) --
The image builder name to display.
VpcConfig (dict) --
The VPC configuration of the image builder.
SubnetIds (list) --
The identifiers of the subnets to which a network interface is attached from the fleet instance or image builder instance. Fleet instances use one or more subnets. Image builder instances use one subnet.
(string) --
SecurityGroupIds (list) --
The identifiers of the security groups for the fleet or image builder.
(string) --
InstanceType (string) --
The instance type for the image builder. The following instance types are available:
stream.standard.small
stream.standard.medium
stream.standard.large
stream.compute.large
stream.compute.xlarge
stream.compute.2xlarge
stream.compute.4xlarge
stream.compute.8xlarge
stream.memory.large
stream.memory.xlarge
stream.memory.2xlarge
stream.memory.4xlarge
stream.memory.8xlarge
stream.memory.z1d.large
stream.memory.z1d.xlarge
stream.memory.z1d.2xlarge
stream.memory.z1d.3xlarge
stream.memory.z1d.6xlarge
stream.memory.z1d.12xlarge
stream.graphics.g4dn.xlarge
stream.graphics.g4dn.2xlarge
stream.graphics.g4dn.4xlarge
stream.graphics.g4dn.8xlarge
stream.graphics.g4dn.12xlarge
stream.graphics.g4dn.16xlarge
stream.graphics.g5.xlarge
stream.graphics.g5.2xlarge
stream.graphics.g5.4xlarge
stream.graphics.g5.8xlarge
stream.graphics.g5.16xlarge
stream.graphics.g5.12xlarge
stream.graphics.g5.24xlarge
stream.graphics.g6.xlarge
stream.graphics.g6.2xlarge
stream.graphics.g6.4xlarge
stream.graphics.g6.8xlarge
stream.graphics.g6.16xlarge
stream.graphics.g6.12xlarge
stream.graphics.g6.24xlarge
stream.graphics.gr6.4xlarge
stream.graphics.gr6.8xlarge
stream.graphics.g6f.large
stream.graphics.g6f.xlarge
stream.graphics.g6f.2xlarge
stream.graphics.g6f.4xlarge
stream.graphics.gr6f.4xlarge
Platform (string) --
The operating system platform of the image builder.
IamRoleArn (string) --
The ARN of the IAM role that is applied to the image builder. To assume a role, the image builder calls the AWS Security Token Service (STS) AssumeRole API operation and passes the ARN of the role to use. The operation creates a new session with temporary credentials. WorkSpaces Applications retrieves the temporary credentials and creates the appstream_machine_role credential profile on the instance.
For more information, see Using an IAM Role to Grant Permissions to Applications and Scripts Running on WorkSpaces Applications Streaming Instances in the Amazon WorkSpaces Applications Administration Guide.
State (string) --
The state of the image builder.
StateChangeReason (dict) --
The reason why the last state change occurred.
Code (string) --
The state change reason code.
Message (string) --
The state change reason message.
CreatedTime (datetime) --
The time stamp when the image builder was created.
EnableDefaultInternetAccess (boolean) --
Enables or disables default internet access for the image builder.
DomainJoinInfo (dict) --
The name of the directory and organizational unit (OU) to use to join the image builder to a Microsoft Active Directory domain.
DirectoryName (string) --
The fully qualified name of the directory (for example, corp.example.com).
OrganizationalUnitDistinguishedName (string) --
The distinguished name of the organizational unit for computer accounts.
NetworkAccessConfiguration (dict) --
Describes the network details of the fleet or image builder instance.
EniPrivateIpAddress (string) --
The private IP address of the elastic network interface that is attached to instances in your VPC.
EniIpv6Addresses (list) --
The IPv6 addresses assigned to the elastic network interface. This field supports IPv6 connectivity for WorkSpaces Applications instances.
(string) --
EniId (string) --
The resource identifier of the elastic network interface that is attached to instances in your VPC. All network interfaces have the eni-xxxxxxxx resource identifier.
ImageBuilderErrors (list) --
The image builder errors.
(dict) --
Describes a resource error.
ErrorCode (string) --
The error code.
ErrorMessage (string) --
The error message.
ErrorTimestamp (datetime) --
The time the error occurred.
AppstreamAgentVersion (string) --
The version of the WorkSpaces Applications agent that is currently being used by the image builder.
AccessEndpoints (list) --
The list of virtual private cloud (VPC) interface endpoint objects. Administrators can connect to the image builder only through the specified endpoints.
(dict) --
Describes an interface VPC endpoint (interface endpoint) that lets you create a private connection between the virtual private cloud (VPC) that you specify and WorkSpaces Applications. When you specify an interface endpoint for a stack, users of the stack can connect to WorkSpaces Applications only through that endpoint. When you specify an interface endpoint for an image builder, administrators can connect to the image builder only through that endpoint.
EndpointType (string) --
The type of interface endpoint.
VpceId (string) --
The identifier (ID) of the VPC in which the interface endpoint is used.
RootVolumeConfig (dict) --
The current configuration of the root volume for the image builder, including the storage size in GB.
VolumeSizeInGb (integer) --
The size of the root volume in GB. Valid range is 200-500 GB. The default is 200 GB, which is included in the hourly instance rate. Additional storage beyond 200 GB incurs extra charges and applies to instances regardless of their running state.
LatestAppstreamAgentVersion (string) --
Indicates whether the image builder is using the latest WorkSpaces Applications agent version or not.
DisableIMDSV1 (boolean) --
Indicates whether Instance Metadata Service Version 1 (IMDSv1) is disabled for the image builder.
AgentAccessConfig (dict) --
The agent access configuration of the image builder, if agent access is enabled.
Settings (list) --
The list of agent access settings that define permissions for each agent action. You must specify at least one setting, and at least one agent action must be enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) --
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) --
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots are stored. Required when ScreenshotsUploadEnabled is true.
ScreenshotsUploadEnabled (boolean) --
Specifies whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ScreenResolution (string) --
The screen resolution for the agent streaming environment.
W_1280xH_720 - 1280 x 720 pixels.
ScreenImageFormat (string) --
The image format for agent screen captures.
PNG - PNG format.
JPEG - JPEG format.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
VIEW_ONLY - Users can view and observe agent actions as they happen.
VIEW_STOP - Users can view agent actions and stop the agent if needed.
DISABLED - Users cannot view or stop the agent session.
{'AgentAccessConfig': {'S3BucketArn': 'string',
'ScreenImageFormat': 'PNG | JPEG',
'ScreenResolution': 'W_1280xH_720',
'ScreenshotsUploadEnabled': 'boolean',
'Settings': [{'AgentAction': 'COMPUTER_VISION | '
'COMPUTER_INPUT | '
'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED | DISABLED'}],
'UserControlMode': 'VIEW_ONLY | VIEW_STOP | DISABLED'}}
Response {'ImageBuilder': {'AgentAccessConfig': {'S3BucketArn': 'string',
'ScreenImageFormat': 'PNG | JPEG',
'ScreenResolution': 'W_1280xH_720',
'ScreenshotsUploadEnabled': 'boolean',
'Settings': [{'AgentAction': 'COMPUTER_VISION '
'| '
'COMPUTER_INPUT '
'| '
'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED | '
'DISABLED'}],
'UserControlMode': 'VIEW_ONLY | '
'VIEW_STOP | '
'DISABLED'}}}
Creates an image builder. An image builder is a virtual machine that is used to create an image.
The initial state of the builder is PENDING. When it is ready, the state is RUNNING.
See also: AWS API Documentation
Request Syntax
client.create_image_builder(
Name='string',
ImageName='string',
ImageArn='string',
InstanceType='string',
Description='string',
DisplayName='string',
VpcConfig={
'SubnetIds': [
'string',
],
'SecurityGroupIds': [
'string',
]
},
IamRoleArn='string',
EnableDefaultInternetAccess=True|False,
DomainJoinInfo={
'DirectoryName': 'string',
'OrganizationalUnitDistinguishedName': 'string'
},
AppstreamAgentVersion='string',
Tags={
'string': 'string'
},
AccessEndpoints=[
{
'EndpointType': 'STREAMING',
'VpceId': 'string'
},
],
RootVolumeConfig={
'VolumeSizeInGb': 123
},
SoftwaresToInstall=[
'string',
],
SoftwaresToUninstall=[
'string',
],
DisableIMDSV1=True|False,
AgentAccessConfig={
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
}
)
string
[REQUIRED]
A unique name for the image builder.
string
The name of the image used to create the image builder.
string
The ARN of the public, private, or shared image to use.
string
[REQUIRED]
The instance type to use when launching the image builder. The following instance types are available:
stream.standard.small
stream.standard.medium
stream.standard.large
stream.compute.large
stream.compute.xlarge
stream.compute.2xlarge
stream.compute.4xlarge
stream.compute.8xlarge
stream.memory.large
stream.memory.xlarge
stream.memory.2xlarge
stream.memory.4xlarge
stream.memory.8xlarge
stream.memory.z1d.large
stream.memory.z1d.xlarge
stream.memory.z1d.2xlarge
stream.memory.z1d.3xlarge
stream.memory.z1d.6xlarge
stream.memory.z1d.12xlarge
stream.graphics.g4dn.xlarge
stream.graphics.g4dn.2xlarge
stream.graphics.g4dn.4xlarge
stream.graphics.g4dn.8xlarge
stream.graphics.g4dn.12xlarge
stream.graphics.g4dn.16xlarge
stream.graphics.g5.xlarge
stream.graphics.g5.2xlarge
stream.graphics.g5.4xlarge
stream.graphics.g5.8xlarge
stream.graphics.g5.16xlarge
stream.graphics.g5.12xlarge
stream.graphics.g5.24xlarge
stream.graphics.g6.xlarge
stream.graphics.g6.2xlarge
stream.graphics.g6.4xlarge
stream.graphics.g6.8xlarge
stream.graphics.g6.16xlarge
stream.graphics.g6.12xlarge
stream.graphics.g6.24xlarge
stream.graphics.gr6.4xlarge
stream.graphics.gr6.8xlarge
stream.graphics.g6f.large
stream.graphics.g6f.xlarge
stream.graphics.g6f.2xlarge
stream.graphics.g6f.4xlarge
stream.graphics.gr6f.4xlarge
string
The description to display.
string
The image builder name to display.
dict
The VPC configuration for the image builder. You can specify only one subnet.
SubnetIds (list) --
The identifiers of the subnets to which a network interface is attached from the fleet instance or image builder instance. Fleet instances use one or more subnets. Image builder instances use one subnet.
(string) --
SecurityGroupIds (list) --
The identifiers of the security groups for the fleet or image builder.
(string) --
string
The Amazon Resource Name (ARN) of the IAM role to apply to the image builder. To assume a role, the image builder calls the AWS Security Token Service (STS) AssumeRole API operation and passes the ARN of the role to use. The operation creates a new session with temporary credentials. WorkSpaces Applications retrieves the temporary credentials and creates the appstream_machine_role credential profile on the instance.
For more information, see Using an IAM Role to Grant Permissions to Applications and Scripts Running on WorkSpaces Applications Streaming Instances in the Amazon WorkSpaces Applications Administration Guide.
boolean
Enables or disables default internet access for the image builder.
dict
The name of the directory and organizational unit (OU) to use to join the image builder to a Microsoft Active Directory domain.
DirectoryName (string) --
The fully qualified name of the directory (for example, corp.example.com).
OrganizationalUnitDistinguishedName (string) --
The distinguished name of the organizational unit for computer accounts.
string
The version of the WorkSpaces Applications agent to use for this image builder. To use the latest version of the WorkSpaces Applications agent, specify [LATEST].
dict
The tags to associate with the image builder. A tag is a key-value pair, and the value is optional. For example, Environment=Test. If you do not specify a value, Environment=.
Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following special characters:
_ . : / = + - @
If you do not specify a value, the value is set to an empty string.
For more information about tags, see Tagging Your Resources in the Amazon WorkSpaces Applications Administration Guide.
(string) --
(string) --
list
The list of interface VPC endpoint (interface endpoint) objects. Administrators can connect to the image builder only through the specified endpoints.
(dict) --
Describes an interface VPC endpoint (interface endpoint) that lets you create a private connection between the virtual private cloud (VPC) that you specify and WorkSpaces Applications. When you specify an interface endpoint for a stack, users of the stack can connect to WorkSpaces Applications only through that endpoint. When you specify an interface endpoint for an image builder, administrators can connect to the image builder only through that endpoint.
EndpointType (string) -- [REQUIRED]
The type of interface endpoint.
VpceId (string) --
The identifier (ID) of the VPC in which the interface endpoint is used.
dict
The configuration for the root volume of the image builder. Use this to customize storage capacity from 200 GB up to 500 GB based on your application installation requirements.
VolumeSizeInGb (integer) --
The size of the root volume in GB. Valid range is 200-500 GB. The default is 200 GB, which is included in the hourly instance rate. Additional storage beyond 200 GB incurs extra charges and applies to instances regardless of their running state.
list
The list of license included applications to install on the image builder during creation.
Possible values include the following:
Microsoft_Office_2021_LTSC_Professional_Plus_32Bit
Microsoft_Office_2021_LTSC_Professional_Plus_64Bit
Microsoft_Office_2024_LTSC_Professional_Plus_32Bit
Microsoft_Office_2024_LTSC_Professional_Plus_64Bit
Microsoft_Visio_2021_LTSC_Professional_32Bit
Microsoft_Visio_2021_LTSC_Professional_64Bit
Microsoft_Visio_2024_LTSC_Professional_32Bit
Microsoft_Visio_2024_LTSC_Professional_64Bit
Microsoft_Project_2021_Professional_32Bit
Microsoft_Project_2021_Professional_64Bit
Microsoft_Project_2024_Professional_32Bit
Microsoft_Project_2024_Professional_64Bit
Microsoft_Office_2021_LTSC_Standard_32Bit
Microsoft_Office_2021_LTSC_Standard_64Bit
Microsoft_Office_2024_LTSC_Standard_32Bit
Microsoft_Office_2024_LTSC_Standard_64Bit
Microsoft_Visio_2021_LTSC_Standard_32Bit
Microsoft_Visio_2021_LTSC_Standard_64Bit
Microsoft_Visio_2024_LTSC_Standard_32Bit
Microsoft_Visio_2024_LTSC_Standard_64Bit
Microsoft_Project_2021_Standard_32Bit
Microsoft_Project_2021_Standard_64Bit
Microsoft_Project_2024_Standard_32Bit
Microsoft_Project_2024_Standard_64Bit
(string) --
list
The list of license included applications to uninstall from the image builder during creation.
Possible values include the following:
Microsoft_Office_2021_LTSC_Professional_Plus_32Bit
Microsoft_Office_2021_LTSC_Professional_Plus_64Bit
Microsoft_Office_2024_LTSC_Professional_Plus_32Bit
Microsoft_Office_2024_LTSC_Professional_Plus_64Bit
Microsoft_Visio_2021_LTSC_Professional_32Bit
Microsoft_Visio_2021_LTSC_Professional_64Bit
Microsoft_Visio_2024_LTSC_Professional_32Bit
Microsoft_Visio_2024_LTSC_Professional_64Bit
Microsoft_Project_2021_Professional_32Bit
Microsoft_Project_2021_Professional_64Bit
Microsoft_Project_2024_Professional_32Bit
Microsoft_Project_2024_Professional_64Bit
Microsoft_Office_2021_LTSC_Standard_32Bit
Microsoft_Office_2021_LTSC_Standard_64Bit
Microsoft_Office_2024_LTSC_Standard_32Bit
Microsoft_Office_2024_LTSC_Standard_64Bit
Microsoft_Visio_2021_LTSC_Standard_32Bit
Microsoft_Visio_2021_LTSC_Standard_64Bit
Microsoft_Visio_2024_LTSC_Standard_32Bit
Microsoft_Visio_2024_LTSC_Standard_64Bit
Microsoft_Project_2021_Standard_32Bit
Microsoft_Project_2021_Standard_64Bit
Microsoft_Project_2024_Standard_32Bit
Microsoft_Project_2024_Standard_64Bit
(string) --
boolean
Set to true to disable Instance Metadata Service Version 1 (IMDSv1) and enforce IMDSv2. Set to false to enable both IMDSv1 and IMDSv2.
dict
The configuration for agent access on the image builder. If specified, agent access is enabled for the image builder.
Settings (list) -- [REQUIRED]
The list of agent access settings that define permissions for each agent action. You must specify at least one setting, and at least one agent action must be enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) -- [REQUIRED]
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) -- [REQUIRED]
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots are stored. Required when ScreenshotsUploadEnabled is true.
ScreenshotsUploadEnabled (boolean) --
Specifies whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ScreenResolution (string) -- [REQUIRED]
The screen resolution for the agent streaming environment.
W_1280xH_720 - 1280 x 720 pixels.
ScreenImageFormat (string) -- [REQUIRED]
The image format for agent screen captures.
PNG - PNG format.
JPEG - JPEG format.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
VIEW_ONLY - Users can view and observe agent actions as they happen.
VIEW_STOP - Users can view agent actions and stop the agent if needed.
DISABLED - Users cannot view or stop the agent session.
dict
Response Syntax
{
'ImageBuilder': {
'Name': 'string',
'Arn': 'string',
'ImageArn': 'string',
'Description': 'string',
'DisplayName': 'string',
'VpcConfig': {
'SubnetIds': [
'string',
],
'SecurityGroupIds': [
'string',
]
},
'InstanceType': 'string',
'Platform': 'WINDOWS'|'WINDOWS_SERVER_2016'|'WINDOWS_SERVER_2019'|'WINDOWS_SERVER_2022'|'WINDOWS_SERVER_2025'|'WINDOWS_11'|'AMAZON_LINUX2'|'RHEL8'|'ROCKY_LINUX8'|'UBUNTU_PRO_2404',
'IamRoleArn': 'string',
'State': 'PENDING'|'UPDATING_AGENT'|'RUNNING'|'STOPPING'|'STOPPED'|'REBOOTING'|'SNAPSHOTTING'|'DELETING'|'FAILED'|'UPDATING'|'PENDING_QUALIFICATION'|'PENDING_SYNCING_APPS'|'SYNCING_APPS'|'PENDING_IMAGE_IMPORT',
'StateChangeReason': {
'Code': 'INTERNAL_ERROR'|'IMAGE_UNAVAILABLE',
'Message': 'string'
},
'CreatedTime': datetime(2015, 1, 1),
'EnableDefaultInternetAccess': True|False,
'DomainJoinInfo': {
'DirectoryName': 'string',
'OrganizationalUnitDistinguishedName': 'string'
},
'NetworkAccessConfiguration': {
'EniPrivateIpAddress': 'string',
'EniIpv6Addresses': [
'string',
],
'EniId': 'string'
},
'ImageBuilderErrors': [
{
'ErrorCode': 'IAM_SERVICE_ROLE_MISSING_ENI_DESCRIBE_ACTION'|'IAM_SERVICE_ROLE_MISSING_ENI_CREATE_ACTION'|'IAM_SERVICE_ROLE_MISSING_ENI_DELETE_ACTION'|'NETWORK_INTERFACE_LIMIT_EXCEEDED'|'INTERNAL_SERVICE_ERROR'|'IAM_SERVICE_ROLE_IS_MISSING'|'MACHINE_ROLE_IS_MISSING'|'STS_DISABLED_IN_REGION'|'SUBNET_HAS_INSUFFICIENT_IP_ADDRESSES'|'IAM_SERVICE_ROLE_MISSING_DESCRIBE_SUBNET_ACTION'|'SUBNET_NOT_FOUND'|'IMAGE_NOT_FOUND'|'INVALID_SUBNET_CONFIGURATION'|'SECURITY_GROUPS_NOT_FOUND'|'IGW_NOT_ATTACHED'|'IAM_SERVICE_ROLE_MISSING_DESCRIBE_SECURITY_GROUPS_ACTION'|'FLEET_STOPPED'|'FLEET_INSTANCE_PROVISIONING_FAILURE'|'DOMAIN_JOIN_ERROR_FILE_NOT_FOUND'|'DOMAIN_JOIN_ERROR_ACCESS_DENIED'|'DOMAIN_JOIN_ERROR_LOGON_FAILURE'|'DOMAIN_JOIN_ERROR_INVALID_PARAMETER'|'DOMAIN_JOIN_ERROR_MORE_DATA'|'DOMAIN_JOIN_ERROR_NO_SUCH_DOMAIN'|'DOMAIN_JOIN_ERROR_NOT_SUPPORTED'|'DOMAIN_JOIN_NERR_INVALID_WORKGROUP_NAME'|'DOMAIN_JOIN_NERR_WORKSTATION_NOT_STARTED'|'DOMAIN_JOIN_ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED'|'DOMAIN_JOIN_NERR_PASSWORD_EXPIRED'|'DOMAIN_JOIN_INTERNAL_SERVICE_ERROR'|'VALIDATION_ERROR',
'ErrorMessage': 'string',
'ErrorTimestamp': datetime(2015, 1, 1)
},
],
'AppstreamAgentVersion': 'string',
'AccessEndpoints': [
{
'EndpointType': 'STREAMING',
'VpceId': 'string'
},
],
'RootVolumeConfig': {
'VolumeSizeInGb': 123
},
'LatestAppstreamAgentVersion': 'TRUE'|'FALSE',
'DisableIMDSV1': True|False,
'AgentAccessConfig': {
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
}
}
}
Response Structure
(dict) --
ImageBuilder (dict) --
Information about the image builder.
Name (string) --
The name of the image builder.
Arn (string) --
The ARN for the image builder.
ImageArn (string) --
The ARN of the image from which this builder was created.
Description (string) --
The description to display.
DisplayName (string) --
The image builder name to display.
VpcConfig (dict) --
The VPC configuration of the image builder.
SubnetIds (list) --
The identifiers of the subnets to which a network interface is attached from the fleet instance or image builder instance. Fleet instances use one or more subnets. Image builder instances use one subnet.
(string) --
SecurityGroupIds (list) --
The identifiers of the security groups for the fleet or image builder.
(string) --
InstanceType (string) --
The instance type for the image builder. The following instance types are available:
stream.standard.small
stream.standard.medium
stream.standard.large
stream.compute.large
stream.compute.xlarge
stream.compute.2xlarge
stream.compute.4xlarge
stream.compute.8xlarge
stream.memory.large
stream.memory.xlarge
stream.memory.2xlarge
stream.memory.4xlarge
stream.memory.8xlarge
stream.memory.z1d.large
stream.memory.z1d.xlarge
stream.memory.z1d.2xlarge
stream.memory.z1d.3xlarge
stream.memory.z1d.6xlarge
stream.memory.z1d.12xlarge
stream.graphics.g4dn.xlarge
stream.graphics.g4dn.2xlarge
stream.graphics.g4dn.4xlarge
stream.graphics.g4dn.8xlarge
stream.graphics.g4dn.12xlarge
stream.graphics.g4dn.16xlarge
stream.graphics.g5.xlarge
stream.graphics.g5.2xlarge
stream.graphics.g5.4xlarge
stream.graphics.g5.8xlarge
stream.graphics.g5.16xlarge
stream.graphics.g5.12xlarge
stream.graphics.g5.24xlarge
stream.graphics.g6.xlarge
stream.graphics.g6.2xlarge
stream.graphics.g6.4xlarge
stream.graphics.g6.8xlarge
stream.graphics.g6.16xlarge
stream.graphics.g6.12xlarge
stream.graphics.g6.24xlarge
stream.graphics.gr6.4xlarge
stream.graphics.gr6.8xlarge
stream.graphics.g6f.large
stream.graphics.g6f.xlarge
stream.graphics.g6f.2xlarge
stream.graphics.g6f.4xlarge
stream.graphics.gr6f.4xlarge
Platform (string) --
The operating system platform of the image builder.
IamRoleArn (string) --
The ARN of the IAM role that is applied to the image builder. To assume a role, the image builder calls the AWS Security Token Service (STS) AssumeRole API operation and passes the ARN of the role to use. The operation creates a new session with temporary credentials. WorkSpaces Applications retrieves the temporary credentials and creates the appstream_machine_role credential profile on the instance.
For more information, see Using an IAM Role to Grant Permissions to Applications and Scripts Running on WorkSpaces Applications Streaming Instances in the Amazon WorkSpaces Applications Administration Guide.
State (string) --
The state of the image builder.
StateChangeReason (dict) --
The reason why the last state change occurred.
Code (string) --
The state change reason code.
Message (string) --
The state change reason message.
CreatedTime (datetime) --
The time stamp when the image builder was created.
EnableDefaultInternetAccess (boolean) --
Enables or disables default internet access for the image builder.
DomainJoinInfo (dict) --
The name of the directory and organizational unit (OU) to use to join the image builder to a Microsoft Active Directory domain.
DirectoryName (string) --
The fully qualified name of the directory (for example, corp.example.com).
OrganizationalUnitDistinguishedName (string) --
The distinguished name of the organizational unit for computer accounts.
NetworkAccessConfiguration (dict) --
Describes the network details of the fleet or image builder instance.
EniPrivateIpAddress (string) --
The private IP address of the elastic network interface that is attached to instances in your VPC.
EniIpv6Addresses (list) --
The IPv6 addresses assigned to the elastic network interface. This field supports IPv6 connectivity for WorkSpaces Applications instances.
(string) --
EniId (string) --
The resource identifier of the elastic network interface that is attached to instances in your VPC. All network interfaces have the eni-xxxxxxxx resource identifier.
ImageBuilderErrors (list) --
The image builder errors.
(dict) --
Describes a resource error.
ErrorCode (string) --
The error code.
ErrorMessage (string) --
The error message.
ErrorTimestamp (datetime) --
The time the error occurred.
AppstreamAgentVersion (string) --
The version of the WorkSpaces Applications agent that is currently being used by the image builder.
AccessEndpoints (list) --
The list of virtual private cloud (VPC) interface endpoint objects. Administrators can connect to the image builder only through the specified endpoints.
(dict) --
Describes an interface VPC endpoint (interface endpoint) that lets you create a private connection between the virtual private cloud (VPC) that you specify and WorkSpaces Applications. When you specify an interface endpoint for a stack, users of the stack can connect to WorkSpaces Applications only through that endpoint. When you specify an interface endpoint for an image builder, administrators can connect to the image builder only through that endpoint.
EndpointType (string) --
The type of interface endpoint.
VpceId (string) --
The identifier (ID) of the VPC in which the interface endpoint is used.
RootVolumeConfig (dict) --
The current configuration of the root volume for the image builder, including the storage size in GB.
VolumeSizeInGb (integer) --
The size of the root volume in GB. Valid range is 200-500 GB. The default is 200 GB, which is included in the hourly instance rate. Additional storage beyond 200 GB incurs extra charges and applies to instances regardless of their running state.
LatestAppstreamAgentVersion (string) --
Indicates whether the image builder is using the latest WorkSpaces Applications agent version or not.
DisableIMDSV1 (boolean) --
Indicates whether Instance Metadata Service Version 1 (IMDSv1) is disabled for the image builder.
AgentAccessConfig (dict) --
The agent access configuration of the image builder, if agent access is enabled.
Settings (list) --
The list of agent access settings that define permissions for each agent action. You must specify at least one setting, and at least one agent action must be enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) --
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) --
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots are stored. Required when ScreenshotsUploadEnabled is true.
ScreenshotsUploadEnabled (boolean) --
Specifies whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ScreenResolution (string) --
The screen resolution for the agent streaming environment.
W_1280xH_720 - 1280 x 720 pixels.
ScreenImageFormat (string) --
The image format for agent screen captures.
PNG - PNG format.
JPEG - JPEG format.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
VIEW_ONLY - Users can view and observe agent actions as they happen.
VIEW_STOP - Users can view agent actions and stop the agent if needed.
DISABLED - Users cannot view or stop the agent session.
{'AgentAccessConfig': {'KmsKeyArn': 'string',
'ReplaySessionEnabled': 'boolean'}}
Response {'Stack': {'AgentAccessConfig': {'KmsKeyArn': 'string',
'ReplaySessionEnabled': 'boolean'}}}
Creates a stack to start streaming applications to users. A stack consists of an associated fleet, user access policies, and storage configurations.
See also: AWS API Documentation
Request Syntax
client.create_stack(
Name='string',
Description='string',
DisplayName='string',
StorageConnectors=[
{
'ConnectorType': 'HOMEFOLDERS'|'GOOGLE_DRIVE'|'ONE_DRIVE',
'ResourceIdentifier': 'string',
'Domains': [
'string',
],
'DomainsRequireAdminConsent': [
'string',
]
},
],
RedirectURL='string',
FeedbackURL='string',
UserSettings=[
{
'Action': 'CLIPBOARD_COPY_FROM_LOCAL_DEVICE'|'CLIPBOARD_COPY_TO_LOCAL_DEVICE'|'FILE_UPLOAD'|'FILE_DOWNLOAD'|'PRINTING_TO_LOCAL_DEVICE'|'DOMAIN_PASSWORD_SIGNIN'|'DOMAIN_SMART_CARD_SIGNIN'|'AUTO_TIME_ZONE_REDIRECTION',
'Permission': 'ENABLED'|'DISABLED',
'MaximumLength': 123
},
],
ApplicationSettings={
'Enabled': True|False,
'SettingsGroup': 'string'
},
Tags={
'string': 'string'
},
AccessEndpoints=[
{
'EndpointType': 'STREAMING',
'VpceId': 'string'
},
],
EmbedHostDomains=[
'string',
],
StreamingExperienceSettings={
'PreferredProtocol': 'TCP'|'UDP'
},
ContentRedirection={
'HostToClient': {
'Enabled': True|False,
'AllowedUrls': [
'string',
],
'DeniedUrls': [
'string',
]
}
},
AgentAccessConfig={
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ReplaySessionEnabled': True|False,
'KmsKeyArn': 'string',
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
},
StorageConnectorAuthentication='FORCE_REAUTHENTICATION'|'REUSE_CREDENTIALS'
)
string
[REQUIRED]
The name of the stack.
string
The description to display.
string
The stack name to display.
list
The storage connectors to enable.
(dict) --
Describes a connector that enables persistent storage for users.
ConnectorType (string) -- [REQUIRED]
The type of storage connector.
ResourceIdentifier (string) --
The ARN of the storage connector.
Domains (list) --
The names of the domains for the account.
(string) -- GSuite domain for GDrive integration.
DomainsRequireAdminConsent (list) --
The OneDrive for Business domains where you require admin consent when users try to link their OneDrive account to WorkSpaces Applications. The attribute can only be specified when ConnectorType=ONE_DRIVE.
(string) -- GSuite domain for GDrive integration.
string
The URL that users are redirected to after their streaming session ends.
string
The URL that users are redirected to after they click the Send Feedback link. If no URL is specified, no Send Feedback link is displayed.
list
The actions that are enabled or disabled for users during their streaming sessions. By default, these actions are enabled.
(dict) --
Describes an action and whether the action is enabled or disabled for users during their streaming sessions.
Action (string) -- [REQUIRED]
The action that is enabled or disabled.
Permission (string) -- [REQUIRED]
Indicates whether the action is enabled or disabled.
MaximumLength (integer) --
Specifies the number of characters that can be copied by end users from the local device to the remote session, and to the local device from the remote session.
This can be specified only for the CLIPBOARD_COPY_FROM_LOCAL_DEVICE and CLIPBOARD_COPY_TO_LOCAL_DEVICE actions.
This defaults to 20,971,520 (20 MB) when unspecified and the permission is ENABLED. This can't be specified when the permission is DISABLED.
The value can be between 1 and 20,971,520 (20 MB).
dict
The persistent application settings for users of a stack. When these settings are enabled, changes that users make to applications and Windows settings are automatically saved after each session and applied to the next session.
Enabled (boolean) -- [REQUIRED]
Enables or disables persistent application settings for users during their streaming sessions.
SettingsGroup (string) --
The path prefix for the S3 bucket where users’ persistent application settings are stored. You can allow the same persistent application settings to be used across multiple stacks by specifying the same settings group for each stack.
dict
The tags to associate with the stack. A tag is a key-value pair, and the value is optional. For example, Environment=Test. If you do not specify a value, Environment=.
If you do not specify a value, the value is set to an empty string.
Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following special characters:
_ . : / = + - @
For more information about tags, see Tagging Your Resources in the Amazon WorkSpaces Applications Administration Guide.
(string) --
(string) --
list
The list of interface VPC endpoint (interface endpoint) objects. Users of the stack can connect to WorkSpaces Applications only through the specified endpoints.
(dict) --
Describes an interface VPC endpoint (interface endpoint) that lets you create a private connection between the virtual private cloud (VPC) that you specify and WorkSpaces Applications. When you specify an interface endpoint for a stack, users of the stack can connect to WorkSpaces Applications only through that endpoint. When you specify an interface endpoint for an image builder, administrators can connect to the image builder only through that endpoint.
EndpointType (string) -- [REQUIRED]
The type of interface endpoint.
VpceId (string) --
The identifier (ID) of the VPC in which the interface endpoint is used.
list
The domains where WorkSpaces Applications streaming sessions can be embedded in an iframe. You must approve the domains that you want to host embedded WorkSpaces Applications streaming sessions.
(string) -- Specifies a valid domain that can embed AppStream. Valid examples include: ["testorigin.tt--com", "testingorigin.com.us", "test.com.us"] Invalid examples include: ["test,com", ".com", "h*llo.com". ""]
dict
The streaming protocol you want your stack to prefer. This can be UDP or TCP. Currently, UDP is only supported in the Windows native client.
PreferredProtocol (string) --
The preferred protocol that you want to use while streaming your application.
dict
Configuration for bidirectional URL redirection between the streaming session and the local client. Use HostToClient to redirect URLs from the remote desktop to the local browser.
HostToClient (dict) --
Configuration for redirecting URLs from the remote desktop to the local client browser.
Enabled (boolean) -- [REQUIRED]
Whether URL redirection is enabled for this direction.
AllowedUrls (list) --
List of URL patterns that are allowed to be redirected. URLs matching these patterns will be redirected unless they also match a pattern in the denied list.
(string) --
A glob pattern using wildcards (* for zero or more characters, ? for exactly one character) to match URLs for redirection rules. Patterns do not include a protocol prefix; HTTPS is enforced automatically. Valid examples: , *.example.com, github.com/myorg/, api?.example.com Invalid examples: https://example.com (no protocol), empty string
DeniedUrls (list) --
List of URL patterns that are denied from redirection. This list takes precedence over the allowed list.
(string) --
A glob pattern using wildcards (* for zero or more characters, ? for exactly one character) to match URLs for redirection rules. Patterns do not include a protocol prefix; HTTPS is enforced automatically. Valid examples: , *.example.com, github.com/myorg/, api?.example.com Invalid examples: https://example.com (no protocol), empty string
dict
The configuration for agent access on the stack. If specified, agent access is enabled for the stack.
Settings (list) -- [REQUIRED]
The list of agent access settings that define permissions for each agent action. You must specify at least one setting, and at least one agent action must be enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) -- [REQUIRED]
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) -- [REQUIRED]
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots and Replay Session artifacts are stored. Required when ScreenshotsUploadEnabled or ReplaySessionEnabled is true.
ScreenshotsUploadEnabled (boolean) --
Indicates whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ReplaySessionEnabled (boolean) --
Indicates whether Replay Session is enabled for agent sessions. WorkSpaces Applications delivers a video combining session screenshots, a transcript, and a report for each session. Requires the COMPUTER_VISION agent action.
KmsKeyArn (string) --
The Amazon Resource Name (ARN) of the customer managed symmetric encryption KMS key that encrypts Replay Session artifacts while WorkSpaces Applications processes them. The key must be in the same Region as the stack, and ReplaySessionEnabled must be true.
ScreenResolution (string) -- [REQUIRED]
The screen resolution for the agent streaming environment.
ScreenImageFormat (string) -- [REQUIRED]
The image format for agent screen captures.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
string
Specifies whether users' cloud storage authentication persists across streaming sessions. When you specify FORCE_REAUTHENTICATION, WorkSpaces Applications removes the stored authentication for the stack's OneDrive and Google Drive connectors when a user's session ends. The user links their cloud storage again on their next session. The default is REUSE_CREDENTIALS.
dict
Response Syntax
{
'Stack': {
'Arn': 'string',
'Name': 'string',
'Description': 'string',
'DisplayName': 'string',
'CreatedTime': datetime(2015, 1, 1),
'StorageConnectors': [
{
'ConnectorType': 'HOMEFOLDERS'|'GOOGLE_DRIVE'|'ONE_DRIVE',
'ResourceIdentifier': 'string',
'Domains': [
'string',
],
'DomainsRequireAdminConsent': [
'string',
]
},
],
'RedirectURL': 'string',
'FeedbackURL': 'string',
'StackErrors': [
{
'ErrorCode': 'STORAGE_CONNECTOR_ERROR'|'INTERNAL_SERVICE_ERROR',
'ErrorMessage': 'string'
},
],
'UserSettings': [
{
'Action': 'CLIPBOARD_COPY_FROM_LOCAL_DEVICE'|'CLIPBOARD_COPY_TO_LOCAL_DEVICE'|'FILE_UPLOAD'|'FILE_DOWNLOAD'|'PRINTING_TO_LOCAL_DEVICE'|'DOMAIN_PASSWORD_SIGNIN'|'DOMAIN_SMART_CARD_SIGNIN'|'AUTO_TIME_ZONE_REDIRECTION',
'Permission': 'ENABLED'|'DISABLED',
'MaximumLength': 123
},
],
'ApplicationSettings': {
'Enabled': True|False,
'SettingsGroup': 'string',
'S3BucketName': 'string'
},
'AccessEndpoints': [
{
'EndpointType': 'STREAMING',
'VpceId': 'string'
},
],
'EmbedHostDomains': [
'string',
],
'StreamingExperienceSettings': {
'PreferredProtocol': 'TCP'|'UDP'
},
'ContentRedirection': {
'HostToClient': {
'Enabled': True|False,
'AllowedUrls': [
'string',
],
'DeniedUrls': [
'string',
]
}
},
'AgentAccessConfig': {
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ReplaySessionEnabled': True|False,
'KmsKeyArn': 'string',
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
},
'StorageConnectorAuthentication': 'FORCE_REAUTHENTICATION'|'REUSE_CREDENTIALS'
}
}
Response Structure
(dict) --
Stack (dict) --
Information about the stack.
Arn (string) --
The ARN of the stack.
Name (string) --
The name of the stack.
Description (string) --
The description to display.
DisplayName (string) --
The stack name to display.
CreatedTime (datetime) --
The time the stack was created.
StorageConnectors (list) --
The storage connectors to enable.
(dict) --
Describes a connector that enables persistent storage for users.
ConnectorType (string) --
The type of storage connector.
ResourceIdentifier (string) --
The ARN of the storage connector.
Domains (list) --
The names of the domains for the account.
(string) -- GSuite domain for GDrive integration.
DomainsRequireAdminConsent (list) --
The OneDrive for Business domains where you require admin consent when users try to link their OneDrive account to WorkSpaces Applications. The attribute can only be specified when ConnectorType=ONE_DRIVE.
(string) -- GSuite domain for GDrive integration.
RedirectURL (string) --
The URL that users are redirected to after their streaming session ends.
FeedbackURL (string) --
The URL that users are redirected to after they click the Send Feedback link. If no URL is specified, no Send Feedback link is displayed.
StackErrors (list) --
The errors for the stack.
(dict) --
Describes a stack error.
ErrorCode (string) --
The error code.
ErrorMessage (string) --
The error message.
UserSettings (list) --
The actions that are enabled or disabled for users during their streaming sessions. By default these actions are enabled.
(dict) --
Describes an action and whether the action is enabled or disabled for users during their streaming sessions.
Action (string) --
The action that is enabled or disabled.
Permission (string) --
Indicates whether the action is enabled or disabled.
MaximumLength (integer) --
Specifies the number of characters that can be copied by end users from the local device to the remote session, and to the local device from the remote session.
This can be specified only for the CLIPBOARD_COPY_FROM_LOCAL_DEVICE and CLIPBOARD_COPY_TO_LOCAL_DEVICE actions.
This defaults to 20,971,520 (20 MB) when unspecified and the permission is ENABLED. This can't be specified when the permission is DISABLED.
The value can be between 1 and 20,971,520 (20 MB).
ApplicationSettings (dict) --
The persistent application settings for users of the stack.
Enabled (boolean) --
Specifies whether persistent application settings are enabled for users during their streaming sessions.
SettingsGroup (string) --
The path prefix for the S3 bucket where users’ persistent application settings are stored.
S3BucketName (string) --
The S3 bucket where users’ persistent application settings are stored. When persistent application settings are enabled for the first time for an account in an AWS Region, an S3 bucket is created. The bucket is unique to the AWS account and the Region.
AccessEndpoints (list) --
The list of virtual private cloud (VPC) interface endpoint objects. Users of the stack can connect to WorkSpaces Applications only through the specified endpoints.
(dict) --
Describes an interface VPC endpoint (interface endpoint) that lets you create a private connection between the virtual private cloud (VPC) that you specify and WorkSpaces Applications. When you specify an interface endpoint for a stack, users of the stack can connect to WorkSpaces Applications only through that endpoint. When you specify an interface endpoint for an image builder, administrators can connect to the image builder only through that endpoint.
EndpointType (string) --
The type of interface endpoint.
VpceId (string) --
The identifier (ID) of the VPC in which the interface endpoint is used.
EmbedHostDomains (list) --
The domains where WorkSpaces Applications streaming sessions can be embedded in an iframe. You must approve the domains that you want to host embedded WorkSpaces Applications streaming sessions.
(string) -- Specifies a valid domain that can embed AppStream. Valid examples include: ["testorigin.tt--com", "testingorigin.com.us", "test.com.us"] Invalid examples include: ["test,com", ".com", "h*llo.com". ""]
StreamingExperienceSettings (dict) --
The streaming protocol you want your stack to prefer. This can be UDP or TCP. Currently, UDP is only supported in the Windows native client.
PreferredProtocol (string) --
The preferred protocol that you want to use while streaming your application.
ContentRedirection (dict) --
Configuration for bidirectional URL redirection between the streaming session and the local client. Use HostToClient to redirect URLs from the remote desktop to the local browser.
HostToClient (dict) --
Configuration for redirecting URLs from the remote desktop to the local client browser.
Enabled (boolean) --
Whether URL redirection is enabled for this direction.
AllowedUrls (list) --
List of URL patterns that are allowed to be redirected. URLs matching these patterns will be redirected unless they also match a pattern in the denied list.
(string) --
A glob pattern using wildcards (* for zero or more characters, ? for exactly one character) to match URLs for redirection rules. Patterns do not include a protocol prefix; HTTPS is enforced automatically. Valid examples: , *.example.com, github.com/myorg/, api?.example.com Invalid examples: https://example.com (no protocol), empty string
DeniedUrls (list) --
List of URL patterns that are denied from redirection. This list takes precedence over the allowed list.
(string) --
A glob pattern using wildcards (* for zero or more characters, ? for exactly one character) to match URLs for redirection rules. Patterns do not include a protocol prefix; HTTPS is enforced automatically. Valid examples: , *.example.com, github.com/myorg/, api?.example.com Invalid examples: https://example.com (no protocol), empty string
AgentAccessConfig (dict) --
The agent access configuration of the stack, if agent access is enabled.
Settings (list) --
The list of agent access settings that define permissions for each agent action. You must specify at least one setting, and at least one agent action must be enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) --
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) --
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots and Replay Session artifacts are stored. Required when ScreenshotsUploadEnabled or ReplaySessionEnabled is true.
ScreenshotsUploadEnabled (boolean) --
Indicates whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ReplaySessionEnabled (boolean) --
Indicates whether Replay Session is enabled for agent sessions. WorkSpaces Applications delivers a video combining session screenshots, a transcript, and a report for each session. Requires the COMPUTER_VISION agent action.
KmsKeyArn (string) --
The Amazon Resource Name (ARN) of the customer managed symmetric encryption KMS key that encrypts Replay Session artifacts while WorkSpaces Applications processes them. The key must be in the same Region as the stack, and ReplaySessionEnabled must be true.
ScreenResolution (string) --
The screen resolution for the agent streaming environment.
ScreenImageFormat (string) --
The image format for agent screen captures.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
StorageConnectorAuthentication (string) --
Indicates whether users' cloud storage authentication persists across streaming sessions. When this attribute is FORCE_REAUTHENTICATION, WorkSpaces Applications removes the stored authentication for the stack's OneDrive and Google Drive connectors when a user's session ends. The user links their cloud storage again on their next session. The default is REUSE_CREDENTIALS.
{'ImageBuilder': {'AgentAccessConfig': {'S3BucketArn': 'string',
'ScreenImageFormat': 'PNG | JPEG',
'ScreenResolution': 'W_1280xH_720',
'ScreenshotsUploadEnabled': 'boolean',
'Settings': [{'AgentAction': 'COMPUTER_VISION '
'| '
'COMPUTER_INPUT '
'| '
'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED | '
'DISABLED'}],
'UserControlMode': 'VIEW_ONLY | '
'VIEW_STOP | '
'DISABLED'}}}
Deletes the specified image builder and releases the capacity.
See also: AWS API Documentation
Request Syntax
client.delete_image_builder(
Name='string'
)
string
[REQUIRED]
The name of the image builder.
dict
Response Syntax
{
'ImageBuilder': {
'Name': 'string',
'Arn': 'string',
'ImageArn': 'string',
'Description': 'string',
'DisplayName': 'string',
'VpcConfig': {
'SubnetIds': [
'string',
],
'SecurityGroupIds': [
'string',
]
},
'InstanceType': 'string',
'Platform': 'WINDOWS'|'WINDOWS_SERVER_2016'|'WINDOWS_SERVER_2019'|'WINDOWS_SERVER_2022'|'WINDOWS_SERVER_2025'|'WINDOWS_11'|'AMAZON_LINUX2'|'RHEL8'|'ROCKY_LINUX8'|'UBUNTU_PRO_2404',
'IamRoleArn': 'string',
'State': 'PENDING'|'UPDATING_AGENT'|'RUNNING'|'STOPPING'|'STOPPED'|'REBOOTING'|'SNAPSHOTTING'|'DELETING'|'FAILED'|'UPDATING'|'PENDING_QUALIFICATION'|'PENDING_SYNCING_APPS'|'SYNCING_APPS'|'PENDING_IMAGE_IMPORT',
'StateChangeReason': {
'Code': 'INTERNAL_ERROR'|'IMAGE_UNAVAILABLE',
'Message': 'string'
},
'CreatedTime': datetime(2015, 1, 1),
'EnableDefaultInternetAccess': True|False,
'DomainJoinInfo': {
'DirectoryName': 'string',
'OrganizationalUnitDistinguishedName': 'string'
},
'NetworkAccessConfiguration': {
'EniPrivateIpAddress': 'string',
'EniIpv6Addresses': [
'string',
],
'EniId': 'string'
},
'ImageBuilderErrors': [
{
'ErrorCode': 'IAM_SERVICE_ROLE_MISSING_ENI_DESCRIBE_ACTION'|'IAM_SERVICE_ROLE_MISSING_ENI_CREATE_ACTION'|'IAM_SERVICE_ROLE_MISSING_ENI_DELETE_ACTION'|'NETWORK_INTERFACE_LIMIT_EXCEEDED'|'INTERNAL_SERVICE_ERROR'|'IAM_SERVICE_ROLE_IS_MISSING'|'MACHINE_ROLE_IS_MISSING'|'STS_DISABLED_IN_REGION'|'SUBNET_HAS_INSUFFICIENT_IP_ADDRESSES'|'IAM_SERVICE_ROLE_MISSING_DESCRIBE_SUBNET_ACTION'|'SUBNET_NOT_FOUND'|'IMAGE_NOT_FOUND'|'INVALID_SUBNET_CONFIGURATION'|'SECURITY_GROUPS_NOT_FOUND'|'IGW_NOT_ATTACHED'|'IAM_SERVICE_ROLE_MISSING_DESCRIBE_SECURITY_GROUPS_ACTION'|'FLEET_STOPPED'|'FLEET_INSTANCE_PROVISIONING_FAILURE'|'DOMAIN_JOIN_ERROR_FILE_NOT_FOUND'|'DOMAIN_JOIN_ERROR_ACCESS_DENIED'|'DOMAIN_JOIN_ERROR_LOGON_FAILURE'|'DOMAIN_JOIN_ERROR_INVALID_PARAMETER'|'DOMAIN_JOIN_ERROR_MORE_DATA'|'DOMAIN_JOIN_ERROR_NO_SUCH_DOMAIN'|'DOMAIN_JOIN_ERROR_NOT_SUPPORTED'|'DOMAIN_JOIN_NERR_INVALID_WORKGROUP_NAME'|'DOMAIN_JOIN_NERR_WORKSTATION_NOT_STARTED'|'DOMAIN_JOIN_ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED'|'DOMAIN_JOIN_NERR_PASSWORD_EXPIRED'|'DOMAIN_JOIN_INTERNAL_SERVICE_ERROR'|'VALIDATION_ERROR',
'ErrorMessage': 'string',
'ErrorTimestamp': datetime(2015, 1, 1)
},
],
'AppstreamAgentVersion': 'string',
'AccessEndpoints': [
{
'EndpointType': 'STREAMING',
'VpceId': 'string'
},
],
'RootVolumeConfig': {
'VolumeSizeInGb': 123
},
'LatestAppstreamAgentVersion': 'TRUE'|'FALSE',
'DisableIMDSV1': True|False,
'AgentAccessConfig': {
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
}
}
}
Response Structure
(dict) --
ImageBuilder (dict) --
Information about the image builder.
Name (string) --
The name of the image builder.
Arn (string) --
The ARN for the image builder.
ImageArn (string) --
The ARN of the image from which this builder was created.
Description (string) --
The description to display.
DisplayName (string) --
The image builder name to display.
VpcConfig (dict) --
The VPC configuration of the image builder.
SubnetIds (list) --
The identifiers of the subnets to which a network interface is attached from the fleet instance or image builder instance. Fleet instances use one or more subnets. Image builder instances use one subnet.
(string) --
SecurityGroupIds (list) --
The identifiers of the security groups for the fleet or image builder.
(string) --
InstanceType (string) --
The instance type for the image builder. The following instance types are available:
stream.standard.small
stream.standard.medium
stream.standard.large
stream.compute.large
stream.compute.xlarge
stream.compute.2xlarge
stream.compute.4xlarge
stream.compute.8xlarge
stream.memory.large
stream.memory.xlarge
stream.memory.2xlarge
stream.memory.4xlarge
stream.memory.8xlarge
stream.memory.z1d.large
stream.memory.z1d.xlarge
stream.memory.z1d.2xlarge
stream.memory.z1d.3xlarge
stream.memory.z1d.6xlarge
stream.memory.z1d.12xlarge
stream.graphics.g4dn.xlarge
stream.graphics.g4dn.2xlarge
stream.graphics.g4dn.4xlarge
stream.graphics.g4dn.8xlarge
stream.graphics.g4dn.12xlarge
stream.graphics.g4dn.16xlarge
stream.graphics.g5.xlarge
stream.graphics.g5.2xlarge
stream.graphics.g5.4xlarge
stream.graphics.g5.8xlarge
stream.graphics.g5.16xlarge
stream.graphics.g5.12xlarge
stream.graphics.g5.24xlarge
stream.graphics.g6.xlarge
stream.graphics.g6.2xlarge
stream.graphics.g6.4xlarge
stream.graphics.g6.8xlarge
stream.graphics.g6.16xlarge
stream.graphics.g6.12xlarge
stream.graphics.g6.24xlarge
stream.graphics.gr6.4xlarge
stream.graphics.gr6.8xlarge
stream.graphics.g6f.large
stream.graphics.g6f.xlarge
stream.graphics.g6f.2xlarge
stream.graphics.g6f.4xlarge
stream.graphics.gr6f.4xlarge
Platform (string) --
The operating system platform of the image builder.
IamRoleArn (string) --
The ARN of the IAM role that is applied to the image builder. To assume a role, the image builder calls the AWS Security Token Service (STS) AssumeRole API operation and passes the ARN of the role to use. The operation creates a new session with temporary credentials. WorkSpaces Applications retrieves the temporary credentials and creates the appstream_machine_role credential profile on the instance.
For more information, see Using an IAM Role to Grant Permissions to Applications and Scripts Running on WorkSpaces Applications Streaming Instances in the Amazon WorkSpaces Applications Administration Guide.
State (string) --
The state of the image builder.
StateChangeReason (dict) --
The reason why the last state change occurred.
Code (string) --
The state change reason code.
Message (string) --
The state change reason message.
CreatedTime (datetime) --
The time stamp when the image builder was created.
EnableDefaultInternetAccess (boolean) --
Enables or disables default internet access for the image builder.
DomainJoinInfo (dict) --
The name of the directory and organizational unit (OU) to use to join the image builder to a Microsoft Active Directory domain.
DirectoryName (string) --
The fully qualified name of the directory (for example, corp.example.com).
OrganizationalUnitDistinguishedName (string) --
The distinguished name of the organizational unit for computer accounts.
NetworkAccessConfiguration (dict) --
Describes the network details of the fleet or image builder instance.
EniPrivateIpAddress (string) --
The private IP address of the elastic network interface that is attached to instances in your VPC.
EniIpv6Addresses (list) --
The IPv6 addresses assigned to the elastic network interface. This field supports IPv6 connectivity for WorkSpaces Applications instances.
(string) --
EniId (string) --
The resource identifier of the elastic network interface that is attached to instances in your VPC. All network interfaces have the eni-xxxxxxxx resource identifier.
ImageBuilderErrors (list) --
The image builder errors.
(dict) --
Describes a resource error.
ErrorCode (string) --
The error code.
ErrorMessage (string) --
The error message.
ErrorTimestamp (datetime) --
The time the error occurred.
AppstreamAgentVersion (string) --
The version of the WorkSpaces Applications agent that is currently being used by the image builder.
AccessEndpoints (list) --
The list of virtual private cloud (VPC) interface endpoint objects. Administrators can connect to the image builder only through the specified endpoints.
(dict) --
Describes an interface VPC endpoint (interface endpoint) that lets you create a private connection between the virtual private cloud (VPC) that you specify and WorkSpaces Applications. When you specify an interface endpoint for a stack, users of the stack can connect to WorkSpaces Applications only through that endpoint. When you specify an interface endpoint for an image builder, administrators can connect to the image builder only through that endpoint.
EndpointType (string) --
The type of interface endpoint.
VpceId (string) --
The identifier (ID) of the VPC in which the interface endpoint is used.
RootVolumeConfig (dict) --
The current configuration of the root volume for the image builder, including the storage size in GB.
VolumeSizeInGb (integer) --
The size of the root volume in GB. Valid range is 200-500 GB. The default is 200 GB, which is included in the hourly instance rate. Additional storage beyond 200 GB incurs extra charges and applies to instances regardless of their running state.
LatestAppstreamAgentVersion (string) --
Indicates whether the image builder is using the latest WorkSpaces Applications agent version or not.
DisableIMDSV1 (boolean) --
Indicates whether Instance Metadata Service Version 1 (IMDSv1) is disabled for the image builder.
AgentAccessConfig (dict) --
The agent access configuration of the image builder, if agent access is enabled.
Settings (list) --
The list of agent access settings that define permissions for each agent action. You must specify at least one setting, and at least one agent action must be enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) --
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) --
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots are stored. Required when ScreenshotsUploadEnabled is true.
ScreenshotsUploadEnabled (boolean) --
Specifies whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ScreenResolution (string) --
The screen resolution for the agent streaming environment.
W_1280xH_720 - 1280 x 720 pixels.
ScreenImageFormat (string) --
The image format for agent screen captures.
PNG - PNG format.
JPEG - JPEG format.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
VIEW_ONLY - Users can view and observe agent actions as they happen.
VIEW_STOP - Users can view agent actions and stop the agent if needed.
DISABLED - Users cannot view or stop the agent session.
{'ImageBuilders': {'AgentAccessConfig': {'S3BucketArn': 'string',
'ScreenImageFormat': 'PNG | JPEG',
'ScreenResolution': 'W_1280xH_720',
'ScreenshotsUploadEnabled': 'boolean',
'Settings': [{'AgentAction': 'COMPUTER_VISION '
'| '
'COMPUTER_INPUT '
'| '
'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED '
'| '
'DISABLED'}],
'UserControlMode': 'VIEW_ONLY | '
'VIEW_STOP | '
'DISABLED'}}}
Retrieves a list that describes one or more specified image builders, if the image builder names are provided. Otherwise, all image builders in the account are described.
The description of each image builder includes its agent access configuration, if agent access is enabled.
See also: AWS API Documentation
Request Syntax
client.describe_image_builders(
Names=[
'string',
],
MaxResults=123,
NextToken='string'
)
list
The names of the image builders to describe.
(string) --
integer
The maximum size of each page of results.
string
The pagination token to use to retrieve the next page of results for this operation. If this value is null, it retrieves the first page.
dict
Response Syntax
{
'ImageBuilders': [
{
'Name': 'string',
'Arn': 'string',
'ImageArn': 'string',
'Description': 'string',
'DisplayName': 'string',
'VpcConfig': {
'SubnetIds': [
'string',
],
'SecurityGroupIds': [
'string',
]
},
'InstanceType': 'string',
'Platform': 'WINDOWS'|'WINDOWS_SERVER_2016'|'WINDOWS_SERVER_2019'|'WINDOWS_SERVER_2022'|'WINDOWS_SERVER_2025'|'WINDOWS_11'|'AMAZON_LINUX2'|'RHEL8'|'ROCKY_LINUX8'|'UBUNTU_PRO_2404',
'IamRoleArn': 'string',
'State': 'PENDING'|'UPDATING_AGENT'|'RUNNING'|'STOPPING'|'STOPPED'|'REBOOTING'|'SNAPSHOTTING'|'DELETING'|'FAILED'|'UPDATING'|'PENDING_QUALIFICATION'|'PENDING_SYNCING_APPS'|'SYNCING_APPS'|'PENDING_IMAGE_IMPORT',
'StateChangeReason': {
'Code': 'INTERNAL_ERROR'|'IMAGE_UNAVAILABLE',
'Message': 'string'
},
'CreatedTime': datetime(2015, 1, 1),
'EnableDefaultInternetAccess': True|False,
'DomainJoinInfo': {
'DirectoryName': 'string',
'OrganizationalUnitDistinguishedName': 'string'
},
'NetworkAccessConfiguration': {
'EniPrivateIpAddress': 'string',
'EniIpv6Addresses': [
'string',
],
'EniId': 'string'
},
'ImageBuilderErrors': [
{
'ErrorCode': 'IAM_SERVICE_ROLE_MISSING_ENI_DESCRIBE_ACTION'|'IAM_SERVICE_ROLE_MISSING_ENI_CREATE_ACTION'|'IAM_SERVICE_ROLE_MISSING_ENI_DELETE_ACTION'|'NETWORK_INTERFACE_LIMIT_EXCEEDED'|'INTERNAL_SERVICE_ERROR'|'IAM_SERVICE_ROLE_IS_MISSING'|'MACHINE_ROLE_IS_MISSING'|'STS_DISABLED_IN_REGION'|'SUBNET_HAS_INSUFFICIENT_IP_ADDRESSES'|'IAM_SERVICE_ROLE_MISSING_DESCRIBE_SUBNET_ACTION'|'SUBNET_NOT_FOUND'|'IMAGE_NOT_FOUND'|'INVALID_SUBNET_CONFIGURATION'|'SECURITY_GROUPS_NOT_FOUND'|'IGW_NOT_ATTACHED'|'IAM_SERVICE_ROLE_MISSING_DESCRIBE_SECURITY_GROUPS_ACTION'|'FLEET_STOPPED'|'FLEET_INSTANCE_PROVISIONING_FAILURE'|'DOMAIN_JOIN_ERROR_FILE_NOT_FOUND'|'DOMAIN_JOIN_ERROR_ACCESS_DENIED'|'DOMAIN_JOIN_ERROR_LOGON_FAILURE'|'DOMAIN_JOIN_ERROR_INVALID_PARAMETER'|'DOMAIN_JOIN_ERROR_MORE_DATA'|'DOMAIN_JOIN_ERROR_NO_SUCH_DOMAIN'|'DOMAIN_JOIN_ERROR_NOT_SUPPORTED'|'DOMAIN_JOIN_NERR_INVALID_WORKGROUP_NAME'|'DOMAIN_JOIN_NERR_WORKSTATION_NOT_STARTED'|'DOMAIN_JOIN_ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED'|'DOMAIN_JOIN_NERR_PASSWORD_EXPIRED'|'DOMAIN_JOIN_INTERNAL_SERVICE_ERROR'|'VALIDATION_ERROR',
'ErrorMessage': 'string',
'ErrorTimestamp': datetime(2015, 1, 1)
},
],
'AppstreamAgentVersion': 'string',
'AccessEndpoints': [
{
'EndpointType': 'STREAMING',
'VpceId': 'string'
},
],
'RootVolumeConfig': {
'VolumeSizeInGb': 123
},
'LatestAppstreamAgentVersion': 'TRUE'|'FALSE',
'DisableIMDSV1': True|False,
'AgentAccessConfig': {
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
}
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
ImageBuilders (list) --
Information about the image builders.
(dict) --
Describes a virtual machine that is used to create an image.
Name (string) --
The name of the image builder.
Arn (string) --
The ARN for the image builder.
ImageArn (string) --
The ARN of the image from which this builder was created.
Description (string) --
The description to display.
DisplayName (string) --
The image builder name to display.
VpcConfig (dict) --
The VPC configuration of the image builder.
SubnetIds (list) --
The identifiers of the subnets to which a network interface is attached from the fleet instance or image builder instance. Fleet instances use one or more subnets. Image builder instances use one subnet.
(string) --
SecurityGroupIds (list) --
The identifiers of the security groups for the fleet or image builder.
(string) --
InstanceType (string) --
The instance type for the image builder. The following instance types are available:
stream.standard.small
stream.standard.medium
stream.standard.large
stream.compute.large
stream.compute.xlarge
stream.compute.2xlarge
stream.compute.4xlarge
stream.compute.8xlarge
stream.memory.large
stream.memory.xlarge
stream.memory.2xlarge
stream.memory.4xlarge
stream.memory.8xlarge
stream.memory.z1d.large
stream.memory.z1d.xlarge
stream.memory.z1d.2xlarge
stream.memory.z1d.3xlarge
stream.memory.z1d.6xlarge
stream.memory.z1d.12xlarge
stream.graphics.g4dn.xlarge
stream.graphics.g4dn.2xlarge
stream.graphics.g4dn.4xlarge
stream.graphics.g4dn.8xlarge
stream.graphics.g4dn.12xlarge
stream.graphics.g4dn.16xlarge
stream.graphics.g5.xlarge
stream.graphics.g5.2xlarge
stream.graphics.g5.4xlarge
stream.graphics.g5.8xlarge
stream.graphics.g5.16xlarge
stream.graphics.g5.12xlarge
stream.graphics.g5.24xlarge
stream.graphics.g6.xlarge
stream.graphics.g6.2xlarge
stream.graphics.g6.4xlarge
stream.graphics.g6.8xlarge
stream.graphics.g6.16xlarge
stream.graphics.g6.12xlarge
stream.graphics.g6.24xlarge
stream.graphics.gr6.4xlarge
stream.graphics.gr6.8xlarge
stream.graphics.g6f.large
stream.graphics.g6f.xlarge
stream.graphics.g6f.2xlarge
stream.graphics.g6f.4xlarge
stream.graphics.gr6f.4xlarge
Platform (string) --
The operating system platform of the image builder.
IamRoleArn (string) --
The ARN of the IAM role that is applied to the image builder. To assume a role, the image builder calls the AWS Security Token Service (STS) AssumeRole API operation and passes the ARN of the role to use. The operation creates a new session with temporary credentials. WorkSpaces Applications retrieves the temporary credentials and creates the appstream_machine_role credential profile on the instance.
For more information, see Using an IAM Role to Grant Permissions to Applications and Scripts Running on WorkSpaces Applications Streaming Instances in the Amazon WorkSpaces Applications Administration Guide.
State (string) --
The state of the image builder.
StateChangeReason (dict) --
The reason why the last state change occurred.
Code (string) --
The state change reason code.
Message (string) --
The state change reason message.
CreatedTime (datetime) --
The time stamp when the image builder was created.
EnableDefaultInternetAccess (boolean) --
Enables or disables default internet access for the image builder.
DomainJoinInfo (dict) --
The name of the directory and organizational unit (OU) to use to join the image builder to a Microsoft Active Directory domain.
DirectoryName (string) --
The fully qualified name of the directory (for example, corp.example.com).
OrganizationalUnitDistinguishedName (string) --
The distinguished name of the organizational unit for computer accounts.
NetworkAccessConfiguration (dict) --
Describes the network details of the fleet or image builder instance.
EniPrivateIpAddress (string) --
The private IP address of the elastic network interface that is attached to instances in your VPC.
EniIpv6Addresses (list) --
The IPv6 addresses assigned to the elastic network interface. This field supports IPv6 connectivity for WorkSpaces Applications instances.
(string) --
EniId (string) --
The resource identifier of the elastic network interface that is attached to instances in your VPC. All network interfaces have the eni-xxxxxxxx resource identifier.
ImageBuilderErrors (list) --
The image builder errors.
(dict) --
Describes a resource error.
ErrorCode (string) --
The error code.
ErrorMessage (string) --
The error message.
ErrorTimestamp (datetime) --
The time the error occurred.
AppstreamAgentVersion (string) --
The version of the WorkSpaces Applications agent that is currently being used by the image builder.
AccessEndpoints (list) --
The list of virtual private cloud (VPC) interface endpoint objects. Administrators can connect to the image builder only through the specified endpoints.
(dict) --
Describes an interface VPC endpoint (interface endpoint) that lets you create a private connection between the virtual private cloud (VPC) that you specify and WorkSpaces Applications. When you specify an interface endpoint for a stack, users of the stack can connect to WorkSpaces Applications only through that endpoint. When you specify an interface endpoint for an image builder, administrators can connect to the image builder only through that endpoint.
EndpointType (string) --
The type of interface endpoint.
VpceId (string) --
The identifier (ID) of the VPC in which the interface endpoint is used.
RootVolumeConfig (dict) --
The current configuration of the root volume for the image builder, including the storage size in GB.
VolumeSizeInGb (integer) --
The size of the root volume in GB. Valid range is 200-500 GB. The default is 200 GB, which is included in the hourly instance rate. Additional storage beyond 200 GB incurs extra charges and applies to instances regardless of their running state.
LatestAppstreamAgentVersion (string) --
Indicates whether the image builder is using the latest WorkSpaces Applications agent version or not.
DisableIMDSV1 (boolean) --
Indicates whether Instance Metadata Service Version 1 (IMDSv1) is disabled for the image builder.
AgentAccessConfig (dict) --
The agent access configuration of the image builder, if agent access is enabled.
Settings (list) --
The list of agent access settings that define permissions for each agent action. You must specify at least one setting, and at least one agent action must be enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) --
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) --
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots are stored. Required when ScreenshotsUploadEnabled is true.
ScreenshotsUploadEnabled (boolean) --
Specifies whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ScreenResolution (string) --
The screen resolution for the agent streaming environment.
W_1280xH_720 - 1280 x 720 pixels.
ScreenImageFormat (string) --
The image format for agent screen captures.
PNG - PNG format.
JPEG - JPEG format.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
VIEW_ONLY - Users can view and observe agent actions as they happen.
VIEW_STOP - Users can view agent actions and stop the agent if needed.
DISABLED - Users cannot view or stop the agent session.
NextToken (string) --
The pagination token to use to retrieve the next page of results for this operation. If there are no more pages, this value is null.
{'Stacks': {'AgentAccessConfig': {'KmsKeyArn': 'string',
'ReplaySessionEnabled': 'boolean'}}}
Retrieves a list that describes one or more specified stacks, if the stack names are provided. Otherwise, all stacks in the account are described.
See also: AWS API Documentation
Request Syntax
client.describe_stacks(
Names=[
'string',
],
NextToken='string'
)
list
The names of the stacks to describe.
(string) --
string
The pagination token to use to retrieve the next page of results for this operation. If this value is null, it retrieves the first page.
dict
Response Syntax
{
'Stacks': [
{
'Arn': 'string',
'Name': 'string',
'Description': 'string',
'DisplayName': 'string',
'CreatedTime': datetime(2015, 1, 1),
'StorageConnectors': [
{
'ConnectorType': 'HOMEFOLDERS'|'GOOGLE_DRIVE'|'ONE_DRIVE',
'ResourceIdentifier': 'string',
'Domains': [
'string',
],
'DomainsRequireAdminConsent': [
'string',
]
},
],
'RedirectURL': 'string',
'FeedbackURL': 'string',
'StackErrors': [
{
'ErrorCode': 'STORAGE_CONNECTOR_ERROR'|'INTERNAL_SERVICE_ERROR',
'ErrorMessage': 'string'
},
],
'UserSettings': [
{
'Action': 'CLIPBOARD_COPY_FROM_LOCAL_DEVICE'|'CLIPBOARD_COPY_TO_LOCAL_DEVICE'|'FILE_UPLOAD'|'FILE_DOWNLOAD'|'PRINTING_TO_LOCAL_DEVICE'|'DOMAIN_PASSWORD_SIGNIN'|'DOMAIN_SMART_CARD_SIGNIN'|'AUTO_TIME_ZONE_REDIRECTION',
'Permission': 'ENABLED'|'DISABLED',
'MaximumLength': 123
},
],
'ApplicationSettings': {
'Enabled': True|False,
'SettingsGroup': 'string',
'S3BucketName': 'string'
},
'AccessEndpoints': [
{
'EndpointType': 'STREAMING',
'VpceId': 'string'
},
],
'EmbedHostDomains': [
'string',
],
'StreamingExperienceSettings': {
'PreferredProtocol': 'TCP'|'UDP'
},
'ContentRedirection': {
'HostToClient': {
'Enabled': True|False,
'AllowedUrls': [
'string',
],
'DeniedUrls': [
'string',
]
}
},
'AgentAccessConfig': {
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ReplaySessionEnabled': True|False,
'KmsKeyArn': 'string',
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
},
'StorageConnectorAuthentication': 'FORCE_REAUTHENTICATION'|'REUSE_CREDENTIALS'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
Stacks (list) --
Information about the stacks.
(dict) --
Describes a stack.
Arn (string) --
The ARN of the stack.
Name (string) --
The name of the stack.
Description (string) --
The description to display.
DisplayName (string) --
The stack name to display.
CreatedTime (datetime) --
The time the stack was created.
StorageConnectors (list) --
The storage connectors to enable.
(dict) --
Describes a connector that enables persistent storage for users.
ConnectorType (string) --
The type of storage connector.
ResourceIdentifier (string) --
The ARN of the storage connector.
Domains (list) --
The names of the domains for the account.
(string) -- GSuite domain for GDrive integration.
DomainsRequireAdminConsent (list) --
The OneDrive for Business domains where you require admin consent when users try to link their OneDrive account to WorkSpaces Applications. The attribute can only be specified when ConnectorType=ONE_DRIVE.
(string) -- GSuite domain for GDrive integration.
RedirectURL (string) --
The URL that users are redirected to after their streaming session ends.
FeedbackURL (string) --
The URL that users are redirected to after they click the Send Feedback link. If no URL is specified, no Send Feedback link is displayed.
StackErrors (list) --
The errors for the stack.
(dict) --
Describes a stack error.
ErrorCode (string) --
The error code.
ErrorMessage (string) --
The error message.
UserSettings (list) --
The actions that are enabled or disabled for users during their streaming sessions. By default these actions are enabled.
(dict) --
Describes an action and whether the action is enabled or disabled for users during their streaming sessions.
Action (string) --
The action that is enabled or disabled.
Permission (string) --
Indicates whether the action is enabled or disabled.
MaximumLength (integer) --
Specifies the number of characters that can be copied by end users from the local device to the remote session, and to the local device from the remote session.
This can be specified only for the CLIPBOARD_COPY_FROM_LOCAL_DEVICE and CLIPBOARD_COPY_TO_LOCAL_DEVICE actions.
This defaults to 20,971,520 (20 MB) when unspecified and the permission is ENABLED. This can't be specified when the permission is DISABLED.
The value can be between 1 and 20,971,520 (20 MB).
ApplicationSettings (dict) --
The persistent application settings for users of the stack.
Enabled (boolean) --
Specifies whether persistent application settings are enabled for users during their streaming sessions.
SettingsGroup (string) --
The path prefix for the S3 bucket where users’ persistent application settings are stored.
S3BucketName (string) --
The S3 bucket where users’ persistent application settings are stored. When persistent application settings are enabled for the first time for an account in an AWS Region, an S3 bucket is created. The bucket is unique to the AWS account and the Region.
AccessEndpoints (list) --
The list of virtual private cloud (VPC) interface endpoint objects. Users of the stack can connect to WorkSpaces Applications only through the specified endpoints.
(dict) --
Describes an interface VPC endpoint (interface endpoint) that lets you create a private connection between the virtual private cloud (VPC) that you specify and WorkSpaces Applications. When you specify an interface endpoint for a stack, users of the stack can connect to WorkSpaces Applications only through that endpoint. When you specify an interface endpoint for an image builder, administrators can connect to the image builder only through that endpoint.
EndpointType (string) --
The type of interface endpoint.
VpceId (string) --
The identifier (ID) of the VPC in which the interface endpoint is used.
EmbedHostDomains (list) --
The domains where WorkSpaces Applications streaming sessions can be embedded in an iframe. You must approve the domains that you want to host embedded WorkSpaces Applications streaming sessions.
(string) -- Specifies a valid domain that can embed AppStream. Valid examples include: ["testorigin.tt--com", "testingorigin.com.us", "test.com.us"] Invalid examples include: ["test,com", ".com", "h*llo.com". ""]
StreamingExperienceSettings (dict) --
The streaming protocol you want your stack to prefer. This can be UDP or TCP. Currently, UDP is only supported in the Windows native client.
PreferredProtocol (string) --
The preferred protocol that you want to use while streaming your application.
ContentRedirection (dict) --
Configuration for bidirectional URL redirection between the streaming session and the local client. Use HostToClient to redirect URLs from the remote desktop to the local browser.
HostToClient (dict) --
Configuration for redirecting URLs from the remote desktop to the local client browser.
Enabled (boolean) --
Whether URL redirection is enabled for this direction.
AllowedUrls (list) --
List of URL patterns that are allowed to be redirected. URLs matching these patterns will be redirected unless they also match a pattern in the denied list.
(string) --
A glob pattern using wildcards (* for zero or more characters, ? for exactly one character) to match URLs for redirection rules. Patterns do not include a protocol prefix; HTTPS is enforced automatically. Valid examples: , *.example.com, github.com/myorg/, api?.example.com Invalid examples: https://example.com (no protocol), empty string
DeniedUrls (list) --
List of URL patterns that are denied from redirection. This list takes precedence over the allowed list.
(string) --
A glob pattern using wildcards (* for zero or more characters, ? for exactly one character) to match URLs for redirection rules. Patterns do not include a protocol prefix; HTTPS is enforced automatically. Valid examples: , *.example.com, github.com/myorg/, api?.example.com Invalid examples: https://example.com (no protocol), empty string
AgentAccessConfig (dict) --
The agent access configuration of the stack, if agent access is enabled.
Settings (list) --
The list of agent access settings that define permissions for each agent action. You must specify at least one setting, and at least one agent action must be enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) --
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) --
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots and Replay Session artifacts are stored. Required when ScreenshotsUploadEnabled or ReplaySessionEnabled is true.
ScreenshotsUploadEnabled (boolean) --
Indicates whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ReplaySessionEnabled (boolean) --
Indicates whether Replay Session is enabled for agent sessions. WorkSpaces Applications delivers a video combining session screenshots, a transcript, and a report for each session. Requires the COMPUTER_VISION agent action.
KmsKeyArn (string) --
The Amazon Resource Name (ARN) of the customer managed symmetric encryption KMS key that encrypts Replay Session artifacts while WorkSpaces Applications processes them. The key must be in the same Region as the stack, and ReplaySessionEnabled must be true.
ScreenResolution (string) --
The screen resolution for the agent streaming environment.
ScreenImageFormat (string) --
The image format for agent screen captures.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
StorageConnectorAuthentication (string) --
Indicates whether users' cloud storage authentication persists across streaming sessions. When this attribute is FORCE_REAUTHENTICATION, WorkSpaces Applications removes the stored authentication for the stack's OneDrive and Google Drive connectors when a user's session ends. The user links their cloud storage again on their next session. The default is REUSE_CREDENTIALS.
NextToken (string) --
The pagination token to use to retrieve the next page of results for this operation. If there are no more pages, this value is null.
{'ImageBuilder': {'AgentAccessConfig': {'S3BucketArn': 'string',
'ScreenImageFormat': 'PNG | JPEG',
'ScreenResolution': 'W_1280xH_720',
'ScreenshotsUploadEnabled': 'boolean',
'Settings': [{'AgentAction': 'COMPUTER_VISION '
'| '
'COMPUTER_INPUT '
'| '
'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED | '
'DISABLED'}],
'UserControlMode': 'VIEW_ONLY | '
'VIEW_STOP | '
'DISABLED'}}}
Starts the specified image builder.
See also: AWS API Documentation
Request Syntax
client.start_image_builder(
Name='string',
AppstreamAgentVersion='string'
)
string
[REQUIRED]
The name of the image builder.
string
The version of the WorkSpaces Applications agent to use for this image builder. To use the latest version of the WorkSpaces Applications agent, specify [LATEST].
dict
Response Syntax
{
'ImageBuilder': {
'Name': 'string',
'Arn': 'string',
'ImageArn': 'string',
'Description': 'string',
'DisplayName': 'string',
'VpcConfig': {
'SubnetIds': [
'string',
],
'SecurityGroupIds': [
'string',
]
},
'InstanceType': 'string',
'Platform': 'WINDOWS'|'WINDOWS_SERVER_2016'|'WINDOWS_SERVER_2019'|'WINDOWS_SERVER_2022'|'WINDOWS_SERVER_2025'|'WINDOWS_11'|'AMAZON_LINUX2'|'RHEL8'|'ROCKY_LINUX8'|'UBUNTU_PRO_2404',
'IamRoleArn': 'string',
'State': 'PENDING'|'UPDATING_AGENT'|'RUNNING'|'STOPPING'|'STOPPED'|'REBOOTING'|'SNAPSHOTTING'|'DELETING'|'FAILED'|'UPDATING'|'PENDING_QUALIFICATION'|'PENDING_SYNCING_APPS'|'SYNCING_APPS'|'PENDING_IMAGE_IMPORT',
'StateChangeReason': {
'Code': 'INTERNAL_ERROR'|'IMAGE_UNAVAILABLE',
'Message': 'string'
},
'CreatedTime': datetime(2015, 1, 1),
'EnableDefaultInternetAccess': True|False,
'DomainJoinInfo': {
'DirectoryName': 'string',
'OrganizationalUnitDistinguishedName': 'string'
},
'NetworkAccessConfiguration': {
'EniPrivateIpAddress': 'string',
'EniIpv6Addresses': [
'string',
],
'EniId': 'string'
},
'ImageBuilderErrors': [
{
'ErrorCode': 'IAM_SERVICE_ROLE_MISSING_ENI_DESCRIBE_ACTION'|'IAM_SERVICE_ROLE_MISSING_ENI_CREATE_ACTION'|'IAM_SERVICE_ROLE_MISSING_ENI_DELETE_ACTION'|'NETWORK_INTERFACE_LIMIT_EXCEEDED'|'INTERNAL_SERVICE_ERROR'|'IAM_SERVICE_ROLE_IS_MISSING'|'MACHINE_ROLE_IS_MISSING'|'STS_DISABLED_IN_REGION'|'SUBNET_HAS_INSUFFICIENT_IP_ADDRESSES'|'IAM_SERVICE_ROLE_MISSING_DESCRIBE_SUBNET_ACTION'|'SUBNET_NOT_FOUND'|'IMAGE_NOT_FOUND'|'INVALID_SUBNET_CONFIGURATION'|'SECURITY_GROUPS_NOT_FOUND'|'IGW_NOT_ATTACHED'|'IAM_SERVICE_ROLE_MISSING_DESCRIBE_SECURITY_GROUPS_ACTION'|'FLEET_STOPPED'|'FLEET_INSTANCE_PROVISIONING_FAILURE'|'DOMAIN_JOIN_ERROR_FILE_NOT_FOUND'|'DOMAIN_JOIN_ERROR_ACCESS_DENIED'|'DOMAIN_JOIN_ERROR_LOGON_FAILURE'|'DOMAIN_JOIN_ERROR_INVALID_PARAMETER'|'DOMAIN_JOIN_ERROR_MORE_DATA'|'DOMAIN_JOIN_ERROR_NO_SUCH_DOMAIN'|'DOMAIN_JOIN_ERROR_NOT_SUPPORTED'|'DOMAIN_JOIN_NERR_INVALID_WORKGROUP_NAME'|'DOMAIN_JOIN_NERR_WORKSTATION_NOT_STARTED'|'DOMAIN_JOIN_ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED'|'DOMAIN_JOIN_NERR_PASSWORD_EXPIRED'|'DOMAIN_JOIN_INTERNAL_SERVICE_ERROR'|'VALIDATION_ERROR',
'ErrorMessage': 'string',
'ErrorTimestamp': datetime(2015, 1, 1)
},
],
'AppstreamAgentVersion': 'string',
'AccessEndpoints': [
{
'EndpointType': 'STREAMING',
'VpceId': 'string'
},
],
'RootVolumeConfig': {
'VolumeSizeInGb': 123
},
'LatestAppstreamAgentVersion': 'TRUE'|'FALSE',
'DisableIMDSV1': True|False,
'AgentAccessConfig': {
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
}
}
}
Response Structure
(dict) --
ImageBuilder (dict) --
Information about the image builder.
Name (string) --
The name of the image builder.
Arn (string) --
The ARN for the image builder.
ImageArn (string) --
The ARN of the image from which this builder was created.
Description (string) --
The description to display.
DisplayName (string) --
The image builder name to display.
VpcConfig (dict) --
The VPC configuration of the image builder.
SubnetIds (list) --
The identifiers of the subnets to which a network interface is attached from the fleet instance or image builder instance. Fleet instances use one or more subnets. Image builder instances use one subnet.
(string) --
SecurityGroupIds (list) --
The identifiers of the security groups for the fleet or image builder.
(string) --
InstanceType (string) --
The instance type for the image builder. The following instance types are available:
stream.standard.small
stream.standard.medium
stream.standard.large
stream.compute.large
stream.compute.xlarge
stream.compute.2xlarge
stream.compute.4xlarge
stream.compute.8xlarge
stream.memory.large
stream.memory.xlarge
stream.memory.2xlarge
stream.memory.4xlarge
stream.memory.8xlarge
stream.memory.z1d.large
stream.memory.z1d.xlarge
stream.memory.z1d.2xlarge
stream.memory.z1d.3xlarge
stream.memory.z1d.6xlarge
stream.memory.z1d.12xlarge
stream.graphics.g4dn.xlarge
stream.graphics.g4dn.2xlarge
stream.graphics.g4dn.4xlarge
stream.graphics.g4dn.8xlarge
stream.graphics.g4dn.12xlarge
stream.graphics.g4dn.16xlarge
stream.graphics.g5.xlarge
stream.graphics.g5.2xlarge
stream.graphics.g5.4xlarge
stream.graphics.g5.8xlarge
stream.graphics.g5.16xlarge
stream.graphics.g5.12xlarge
stream.graphics.g5.24xlarge
stream.graphics.g6.xlarge
stream.graphics.g6.2xlarge
stream.graphics.g6.4xlarge
stream.graphics.g6.8xlarge
stream.graphics.g6.16xlarge
stream.graphics.g6.12xlarge
stream.graphics.g6.24xlarge
stream.graphics.gr6.4xlarge
stream.graphics.gr6.8xlarge
stream.graphics.g6f.large
stream.graphics.g6f.xlarge
stream.graphics.g6f.2xlarge
stream.graphics.g6f.4xlarge
stream.graphics.gr6f.4xlarge
Platform (string) --
The operating system platform of the image builder.
IamRoleArn (string) --
The ARN of the IAM role that is applied to the image builder. To assume a role, the image builder calls the AWS Security Token Service (STS) AssumeRole API operation and passes the ARN of the role to use. The operation creates a new session with temporary credentials. WorkSpaces Applications retrieves the temporary credentials and creates the appstream_machine_role credential profile on the instance.
For more information, see Using an IAM Role to Grant Permissions to Applications and Scripts Running on WorkSpaces Applications Streaming Instances in the Amazon WorkSpaces Applications Administration Guide.
State (string) --
The state of the image builder.
StateChangeReason (dict) --
The reason why the last state change occurred.
Code (string) --
The state change reason code.
Message (string) --
The state change reason message.
CreatedTime (datetime) --
The time stamp when the image builder was created.
EnableDefaultInternetAccess (boolean) --
Enables or disables default internet access for the image builder.
DomainJoinInfo (dict) --
The name of the directory and organizational unit (OU) to use to join the image builder to a Microsoft Active Directory domain.
DirectoryName (string) --
The fully qualified name of the directory (for example, corp.example.com).
OrganizationalUnitDistinguishedName (string) --
The distinguished name of the organizational unit for computer accounts.
NetworkAccessConfiguration (dict) --
Describes the network details of the fleet or image builder instance.
EniPrivateIpAddress (string) --
The private IP address of the elastic network interface that is attached to instances in your VPC.
EniIpv6Addresses (list) --
The IPv6 addresses assigned to the elastic network interface. This field supports IPv6 connectivity for WorkSpaces Applications instances.
(string) --
EniId (string) --
The resource identifier of the elastic network interface that is attached to instances in your VPC. All network interfaces have the eni-xxxxxxxx resource identifier.
ImageBuilderErrors (list) --
The image builder errors.
(dict) --
Describes a resource error.
ErrorCode (string) --
The error code.
ErrorMessage (string) --
The error message.
ErrorTimestamp (datetime) --
The time the error occurred.
AppstreamAgentVersion (string) --
The version of the WorkSpaces Applications agent that is currently being used by the image builder.
AccessEndpoints (list) --
The list of virtual private cloud (VPC) interface endpoint objects. Administrators can connect to the image builder only through the specified endpoints.
(dict) --
Describes an interface VPC endpoint (interface endpoint) that lets you create a private connection between the virtual private cloud (VPC) that you specify and WorkSpaces Applications. When you specify an interface endpoint for a stack, users of the stack can connect to WorkSpaces Applications only through that endpoint. When you specify an interface endpoint for an image builder, administrators can connect to the image builder only through that endpoint.
EndpointType (string) --
The type of interface endpoint.
VpceId (string) --
The identifier (ID) of the VPC in which the interface endpoint is used.
RootVolumeConfig (dict) --
The current configuration of the root volume for the image builder, including the storage size in GB.
VolumeSizeInGb (integer) --
The size of the root volume in GB. Valid range is 200-500 GB. The default is 200 GB, which is included in the hourly instance rate. Additional storage beyond 200 GB incurs extra charges and applies to instances regardless of their running state.
LatestAppstreamAgentVersion (string) --
Indicates whether the image builder is using the latest WorkSpaces Applications agent version or not.
DisableIMDSV1 (boolean) --
Indicates whether Instance Metadata Service Version 1 (IMDSv1) is disabled for the image builder.
AgentAccessConfig (dict) --
The agent access configuration of the image builder, if agent access is enabled.
Settings (list) --
The list of agent access settings that define permissions for each agent action. You must specify at least one setting, and at least one agent action must be enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) --
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) --
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots are stored. Required when ScreenshotsUploadEnabled is true.
ScreenshotsUploadEnabled (boolean) --
Specifies whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ScreenResolution (string) --
The screen resolution for the agent streaming environment.
W_1280xH_720 - 1280 x 720 pixels.
ScreenImageFormat (string) --
The image format for agent screen captures.
PNG - PNG format.
JPEG - JPEG format.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
VIEW_ONLY - Users can view and observe agent actions as they happen.
VIEW_STOP - Users can view agent actions and stop the agent if needed.
DISABLED - Users cannot view or stop the agent session.
{'ImageBuilder': {'AgentAccessConfig': {'S3BucketArn': 'string',
'ScreenImageFormat': 'PNG | JPEG',
'ScreenResolution': 'W_1280xH_720',
'ScreenshotsUploadEnabled': 'boolean',
'Settings': [{'AgentAction': 'COMPUTER_VISION '
'| '
'COMPUTER_INPUT '
'| '
'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED | '
'DISABLED'}],
'UserControlMode': 'VIEW_ONLY | '
'VIEW_STOP | '
'DISABLED'}}}
Stops the specified image builder.
See also: AWS API Documentation
Request Syntax
client.stop_image_builder(
Name='string'
)
string
[REQUIRED]
The name of the image builder.
dict
Response Syntax
{
'ImageBuilder': {
'Name': 'string',
'Arn': 'string',
'ImageArn': 'string',
'Description': 'string',
'DisplayName': 'string',
'VpcConfig': {
'SubnetIds': [
'string',
],
'SecurityGroupIds': [
'string',
]
},
'InstanceType': 'string',
'Platform': 'WINDOWS'|'WINDOWS_SERVER_2016'|'WINDOWS_SERVER_2019'|'WINDOWS_SERVER_2022'|'WINDOWS_SERVER_2025'|'WINDOWS_11'|'AMAZON_LINUX2'|'RHEL8'|'ROCKY_LINUX8'|'UBUNTU_PRO_2404',
'IamRoleArn': 'string',
'State': 'PENDING'|'UPDATING_AGENT'|'RUNNING'|'STOPPING'|'STOPPED'|'REBOOTING'|'SNAPSHOTTING'|'DELETING'|'FAILED'|'UPDATING'|'PENDING_QUALIFICATION'|'PENDING_SYNCING_APPS'|'SYNCING_APPS'|'PENDING_IMAGE_IMPORT',
'StateChangeReason': {
'Code': 'INTERNAL_ERROR'|'IMAGE_UNAVAILABLE',
'Message': 'string'
},
'CreatedTime': datetime(2015, 1, 1),
'EnableDefaultInternetAccess': True|False,
'DomainJoinInfo': {
'DirectoryName': 'string',
'OrganizationalUnitDistinguishedName': 'string'
},
'NetworkAccessConfiguration': {
'EniPrivateIpAddress': 'string',
'EniIpv6Addresses': [
'string',
],
'EniId': 'string'
},
'ImageBuilderErrors': [
{
'ErrorCode': 'IAM_SERVICE_ROLE_MISSING_ENI_DESCRIBE_ACTION'|'IAM_SERVICE_ROLE_MISSING_ENI_CREATE_ACTION'|'IAM_SERVICE_ROLE_MISSING_ENI_DELETE_ACTION'|'NETWORK_INTERFACE_LIMIT_EXCEEDED'|'INTERNAL_SERVICE_ERROR'|'IAM_SERVICE_ROLE_IS_MISSING'|'MACHINE_ROLE_IS_MISSING'|'STS_DISABLED_IN_REGION'|'SUBNET_HAS_INSUFFICIENT_IP_ADDRESSES'|'IAM_SERVICE_ROLE_MISSING_DESCRIBE_SUBNET_ACTION'|'SUBNET_NOT_FOUND'|'IMAGE_NOT_FOUND'|'INVALID_SUBNET_CONFIGURATION'|'SECURITY_GROUPS_NOT_FOUND'|'IGW_NOT_ATTACHED'|'IAM_SERVICE_ROLE_MISSING_DESCRIBE_SECURITY_GROUPS_ACTION'|'FLEET_STOPPED'|'FLEET_INSTANCE_PROVISIONING_FAILURE'|'DOMAIN_JOIN_ERROR_FILE_NOT_FOUND'|'DOMAIN_JOIN_ERROR_ACCESS_DENIED'|'DOMAIN_JOIN_ERROR_LOGON_FAILURE'|'DOMAIN_JOIN_ERROR_INVALID_PARAMETER'|'DOMAIN_JOIN_ERROR_MORE_DATA'|'DOMAIN_JOIN_ERROR_NO_SUCH_DOMAIN'|'DOMAIN_JOIN_ERROR_NOT_SUPPORTED'|'DOMAIN_JOIN_NERR_INVALID_WORKGROUP_NAME'|'DOMAIN_JOIN_NERR_WORKSTATION_NOT_STARTED'|'DOMAIN_JOIN_ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED'|'DOMAIN_JOIN_NERR_PASSWORD_EXPIRED'|'DOMAIN_JOIN_INTERNAL_SERVICE_ERROR'|'VALIDATION_ERROR',
'ErrorMessage': 'string',
'ErrorTimestamp': datetime(2015, 1, 1)
},
],
'AppstreamAgentVersion': 'string',
'AccessEndpoints': [
{
'EndpointType': 'STREAMING',
'VpceId': 'string'
},
],
'RootVolumeConfig': {
'VolumeSizeInGb': 123
},
'LatestAppstreamAgentVersion': 'TRUE'|'FALSE',
'DisableIMDSV1': True|False,
'AgentAccessConfig': {
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
}
}
}
Response Structure
(dict) --
ImageBuilder (dict) --
Information about the image builder.
Name (string) --
The name of the image builder.
Arn (string) --
The ARN for the image builder.
ImageArn (string) --
The ARN of the image from which this builder was created.
Description (string) --
The description to display.
DisplayName (string) --
The image builder name to display.
VpcConfig (dict) --
The VPC configuration of the image builder.
SubnetIds (list) --
The identifiers of the subnets to which a network interface is attached from the fleet instance or image builder instance. Fleet instances use one or more subnets. Image builder instances use one subnet.
(string) --
SecurityGroupIds (list) --
The identifiers of the security groups for the fleet or image builder.
(string) --
InstanceType (string) --
The instance type for the image builder. The following instance types are available:
stream.standard.small
stream.standard.medium
stream.standard.large
stream.compute.large
stream.compute.xlarge
stream.compute.2xlarge
stream.compute.4xlarge
stream.compute.8xlarge
stream.memory.large
stream.memory.xlarge
stream.memory.2xlarge
stream.memory.4xlarge
stream.memory.8xlarge
stream.memory.z1d.large
stream.memory.z1d.xlarge
stream.memory.z1d.2xlarge
stream.memory.z1d.3xlarge
stream.memory.z1d.6xlarge
stream.memory.z1d.12xlarge
stream.graphics.g4dn.xlarge
stream.graphics.g4dn.2xlarge
stream.graphics.g4dn.4xlarge
stream.graphics.g4dn.8xlarge
stream.graphics.g4dn.12xlarge
stream.graphics.g4dn.16xlarge
stream.graphics.g5.xlarge
stream.graphics.g5.2xlarge
stream.graphics.g5.4xlarge
stream.graphics.g5.8xlarge
stream.graphics.g5.16xlarge
stream.graphics.g5.12xlarge
stream.graphics.g5.24xlarge
stream.graphics.g6.xlarge
stream.graphics.g6.2xlarge
stream.graphics.g6.4xlarge
stream.graphics.g6.8xlarge
stream.graphics.g6.16xlarge
stream.graphics.g6.12xlarge
stream.graphics.g6.24xlarge
stream.graphics.gr6.4xlarge
stream.graphics.gr6.8xlarge
stream.graphics.g6f.large
stream.graphics.g6f.xlarge
stream.graphics.g6f.2xlarge
stream.graphics.g6f.4xlarge
stream.graphics.gr6f.4xlarge
Platform (string) --
The operating system platform of the image builder.
IamRoleArn (string) --
The ARN of the IAM role that is applied to the image builder. To assume a role, the image builder calls the AWS Security Token Service (STS) AssumeRole API operation and passes the ARN of the role to use. The operation creates a new session with temporary credentials. WorkSpaces Applications retrieves the temporary credentials and creates the appstream_machine_role credential profile on the instance.
For more information, see Using an IAM Role to Grant Permissions to Applications and Scripts Running on WorkSpaces Applications Streaming Instances in the Amazon WorkSpaces Applications Administration Guide.
State (string) --
The state of the image builder.
StateChangeReason (dict) --
The reason why the last state change occurred.
Code (string) --
The state change reason code.
Message (string) --
The state change reason message.
CreatedTime (datetime) --
The time stamp when the image builder was created.
EnableDefaultInternetAccess (boolean) --
Enables or disables default internet access for the image builder.
DomainJoinInfo (dict) --
The name of the directory and organizational unit (OU) to use to join the image builder to a Microsoft Active Directory domain.
DirectoryName (string) --
The fully qualified name of the directory (for example, corp.example.com).
OrganizationalUnitDistinguishedName (string) --
The distinguished name of the organizational unit for computer accounts.
NetworkAccessConfiguration (dict) --
Describes the network details of the fleet or image builder instance.
EniPrivateIpAddress (string) --
The private IP address of the elastic network interface that is attached to instances in your VPC.
EniIpv6Addresses (list) --
The IPv6 addresses assigned to the elastic network interface. This field supports IPv6 connectivity for WorkSpaces Applications instances.
(string) --
EniId (string) --
The resource identifier of the elastic network interface that is attached to instances in your VPC. All network interfaces have the eni-xxxxxxxx resource identifier.
ImageBuilderErrors (list) --
The image builder errors.
(dict) --
Describes a resource error.
ErrorCode (string) --
The error code.
ErrorMessage (string) --
The error message.
ErrorTimestamp (datetime) --
The time the error occurred.
AppstreamAgentVersion (string) --
The version of the WorkSpaces Applications agent that is currently being used by the image builder.
AccessEndpoints (list) --
The list of virtual private cloud (VPC) interface endpoint objects. Administrators can connect to the image builder only through the specified endpoints.
(dict) --
Describes an interface VPC endpoint (interface endpoint) that lets you create a private connection between the virtual private cloud (VPC) that you specify and WorkSpaces Applications. When you specify an interface endpoint for a stack, users of the stack can connect to WorkSpaces Applications only through that endpoint. When you specify an interface endpoint for an image builder, administrators can connect to the image builder only through that endpoint.
EndpointType (string) --
The type of interface endpoint.
VpceId (string) --
The identifier (ID) of the VPC in which the interface endpoint is used.
RootVolumeConfig (dict) --
The current configuration of the root volume for the image builder, including the storage size in GB.
VolumeSizeInGb (integer) --
The size of the root volume in GB. Valid range is 200-500 GB. The default is 200 GB, which is included in the hourly instance rate. Additional storage beyond 200 GB incurs extra charges and applies to instances regardless of their running state.
LatestAppstreamAgentVersion (string) --
Indicates whether the image builder is using the latest WorkSpaces Applications agent version or not.
DisableIMDSV1 (boolean) --
Indicates whether Instance Metadata Service Version 1 (IMDSv1) is disabled for the image builder.
AgentAccessConfig (dict) --
The agent access configuration of the image builder, if agent access is enabled.
Settings (list) --
The list of agent access settings that define permissions for each agent action. You must specify at least one setting, and at least one agent action must be enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) --
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) --
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots are stored. Required when ScreenshotsUploadEnabled is true.
ScreenshotsUploadEnabled (boolean) --
Specifies whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ScreenResolution (string) --
The screen resolution for the agent streaming environment.
W_1280xH_720 - 1280 x 720 pixels.
ScreenImageFormat (string) --
The image format for agent screen captures.
PNG - PNG format.
JPEG - JPEG format.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
VIEW_ONLY - Users can view and observe agent actions as they happen.
VIEW_STOP - Users can view agent actions and stop the agent if needed.
DISABLED - Users cannot view or stop the agent session.
{'AgentAccessConfig': {'KmsKeyArn': 'string',
'ReplaySessionEnabled': 'boolean'},
'AttributesToDelete': {'AGENT_ACCESS_CONFIG_KMS_KEY_ARN'}}
Response {'Stack': {'AgentAccessConfig': {'KmsKeyArn': 'string',
'ReplaySessionEnabled': 'boolean'}}}
Updates the specified fields for the specified stack.
See also: AWS API Documentation
Request Syntax
client.update_stack(
DisplayName='string',
Description='string',
Name='string',
StorageConnectors=[
{
'ConnectorType': 'HOMEFOLDERS'|'GOOGLE_DRIVE'|'ONE_DRIVE',
'ResourceIdentifier': 'string',
'Domains': [
'string',
],
'DomainsRequireAdminConsent': [
'string',
]
},
],
DeleteStorageConnectors=True|False,
RedirectURL='string',
FeedbackURL='string',
AttributesToDelete=[
'STORAGE_CONNECTORS'|'STORAGE_CONNECTOR_HOMEFOLDERS'|'STORAGE_CONNECTOR_GOOGLE_DRIVE'|'STORAGE_CONNECTOR_ONE_DRIVE'|'REDIRECT_URL'|'FEEDBACK_URL'|'THEME_NAME'|'USER_SETTINGS'|'EMBED_HOST_DOMAINS'|'IAM_ROLE_ARN'|'ACCESS_ENDPOINTS'|'STREAMING_EXPERIENCE_SETTINGS'|'CONTENT_REDIRECTION'|'AGENT_ACCESS_CONFIG'|'STORAGE_CONNECTOR_AUTHENTICATION'|'AGENT_ACCESS_CONFIG_KMS_KEY_ARN',
],
UserSettings=[
{
'Action': 'CLIPBOARD_COPY_FROM_LOCAL_DEVICE'|'CLIPBOARD_COPY_TO_LOCAL_DEVICE'|'FILE_UPLOAD'|'FILE_DOWNLOAD'|'PRINTING_TO_LOCAL_DEVICE'|'DOMAIN_PASSWORD_SIGNIN'|'DOMAIN_SMART_CARD_SIGNIN'|'AUTO_TIME_ZONE_REDIRECTION',
'Permission': 'ENABLED'|'DISABLED',
'MaximumLength': 123
},
],
ApplicationSettings={
'Enabled': True|False,
'SettingsGroup': 'string'
},
AccessEndpoints=[
{
'EndpointType': 'STREAMING',
'VpceId': 'string'
},
],
EmbedHostDomains=[
'string',
],
StreamingExperienceSettings={
'PreferredProtocol': 'TCP'|'UDP'
},
ContentRedirection={
'HostToClient': {
'Enabled': True|False,
'AllowedUrls': [
'string',
],
'DeniedUrls': [
'string',
]
}
},
AgentAccessConfig={
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ReplaySessionEnabled': True|False,
'KmsKeyArn': 'string',
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
},
StorageConnectorAuthentication='FORCE_REAUTHENTICATION'|'REUSE_CREDENTIALS'
)
string
The stack name to display.
string
The description to display.
string
[REQUIRED]
The name of the stack.
list
The storage connectors to enable.
(dict) --
Describes a connector that enables persistent storage for users.
ConnectorType (string) -- [REQUIRED]
The type of storage connector.
ResourceIdentifier (string) --
The ARN of the storage connector.
Domains (list) --
The names of the domains for the account.
(string) -- GSuite domain for GDrive integration.
DomainsRequireAdminConsent (list) --
The OneDrive for Business domains where you require admin consent when users try to link their OneDrive account to WorkSpaces Applications. The attribute can only be specified when ConnectorType=ONE_DRIVE.
(string) -- GSuite domain for GDrive integration.
boolean
Deletes the storage connectors currently enabled for the stack.
string
The URL that users are redirected to after their streaming session ends.
string
The URL that users are redirected to after they choose the Send Feedback link. If no URL is specified, no Send Feedback link is displayed.
list
The stack attributes to delete.
(string) --
The stack attributes to delete.
STORAGE_CONNECTORS
STORAGE_CONNECTOR_HOMEFOLDERS
STORAGE_CONNECTOR_GOOGLE_DRIVE
STORAGE_CONNECTOR_ONE_DRIVE
REDIRECT_URL
FEEDBACK_URL
THEME_NAME
USER_SETTINGS
EMBED_HOST_DOMAINS
IAM_ROLE_ARN
ACCESS_ENDPOINTS
STREAMING_EXPERIENCE_SETTINGS
AGENT_ACCESS_CONFIG
AGENT_ACCESS_CONFIG_KMS_KEY_ARN
STORAGE_CONNECTOR_AUTHENTICATION
list
The actions that are enabled or disabled for users during their streaming sessions. By default, these actions are enabled.
(dict) --
Describes an action and whether the action is enabled or disabled for users during their streaming sessions.
Action (string) -- [REQUIRED]
The action that is enabled or disabled.
Permission (string) -- [REQUIRED]
Indicates whether the action is enabled or disabled.
MaximumLength (integer) --
Specifies the number of characters that can be copied by end users from the local device to the remote session, and to the local device from the remote session.
This can be specified only for the CLIPBOARD_COPY_FROM_LOCAL_DEVICE and CLIPBOARD_COPY_TO_LOCAL_DEVICE actions.
This defaults to 20,971,520 (20 MB) when unspecified and the permission is ENABLED. This can't be specified when the permission is DISABLED.
The value can be between 1 and 20,971,520 (20 MB).
dict
The persistent application settings for users of a stack. When these settings are enabled, changes that users make to applications and Windows settings are automatically saved after each session and applied to the next session.
Enabled (boolean) -- [REQUIRED]
Enables or disables persistent application settings for users during their streaming sessions.
SettingsGroup (string) --
The path prefix for the S3 bucket where users’ persistent application settings are stored. You can allow the same persistent application settings to be used across multiple stacks by specifying the same settings group for each stack.
list
The list of interface VPC endpoint (interface endpoint) objects. Users of the stack can connect to WorkSpaces Applications only through the specified endpoints.
(dict) --
Describes an interface VPC endpoint (interface endpoint) that lets you create a private connection between the virtual private cloud (VPC) that you specify and WorkSpaces Applications. When you specify an interface endpoint for a stack, users of the stack can connect to WorkSpaces Applications only through that endpoint. When you specify an interface endpoint for an image builder, administrators can connect to the image builder only through that endpoint.
EndpointType (string) -- [REQUIRED]
The type of interface endpoint.
VpceId (string) --
The identifier (ID) of the VPC in which the interface endpoint is used.
list
The domains where WorkSpaces Applications streaming sessions can be embedded in an iframe. You must approve the domains that you want to host embedded WorkSpaces Applications streaming sessions.
(string) -- Specifies a valid domain that can embed AppStream. Valid examples include: ["testorigin.tt--com", "testingorigin.com.us", "test.com.us"] Invalid examples include: ["test,com", ".com", "h*llo.com". ""]
dict
The streaming protocol you want your stack to prefer. This can be UDP or TCP. Currently, UDP is only supported in the Windows native client.
PreferredProtocol (string) --
The preferred protocol that you want to use while streaming your application.
dict
Configuration for bidirectional URL redirection between the streaming session and the local client. Use HostToClient to redirect URLs from the remote desktop to the local browser.
HostToClient (dict) --
Configuration for redirecting URLs from the remote desktop to the local client browser.
Enabled (boolean) -- [REQUIRED]
Whether URL redirection is enabled for this direction.
AllowedUrls (list) --
List of URL patterns that are allowed to be redirected. URLs matching these patterns will be redirected unless they also match a pattern in the denied list.
(string) --
A glob pattern using wildcards (* for zero or more characters, ? for exactly one character) to match URLs for redirection rules. Patterns do not include a protocol prefix; HTTPS is enforced automatically. Valid examples: , *.example.com, github.com/myorg/, api?.example.com Invalid examples: https://example.com (no protocol), empty string
DeniedUrls (list) --
List of URL patterns that are denied from redirection. This list takes precedence over the allowed list.
(string) --
A glob pattern using wildcards (* for zero or more characters, ? for exactly one character) to match URLs for redirection rules. Patterns do not include a protocol prefix; HTTPS is enforced automatically. Valid examples: , *.example.com, github.com/myorg/, api?.example.com Invalid examples: https://example.com (no protocol), empty string
dict
The configuration for agent access on the stack. Specify this to update agent access settings. To remove agent access, use AttributesToDelete with the AGENT_ACCESS_CONFIG value.
Settings (list) --
The list of agent access settings that define permissions for each agent action. The merged settings must have at least one agent action enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) -- [REQUIRED]
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) -- [REQUIRED]
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots and Replay Session artifacts are stored.
ScreenshotsUploadEnabled (boolean) --
Indicates whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ReplaySessionEnabled (boolean) --
Indicates whether Replay Session is enabled for agent sessions. Setting this attribute to false also removes the KmsKeyArn value from the stack.
KmsKeyArn (string) --
The Amazon Resource Name (ARN) of the customer managed symmetric encryption KMS key that encrypts Replay Session artifacts while WorkSpaces Applications processes them. To remove the key, use AttributesToDelete with the AGENT_ACCESS_CONFIG_KMS_KEY_ARN value.
ScreenResolution (string) --
The screen resolution for the agent streaming environment.
ScreenImageFormat (string) --
The image format for agent screen captures.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
string
Specifies whether users' cloud storage authentication persists across streaming sessions. When you specify FORCE_REAUTHENTICATION, WorkSpaces Applications removes the stored authentication for the stack's OneDrive and Google Drive connectors when a user's session ends. The user links their cloud storage again on their next session. To clear this attribute, add STORAGE_CONNECTOR_AUTHENTICATION to AttributesToDelete.
dict
Response Syntax
{
'Stack': {
'Arn': 'string',
'Name': 'string',
'Description': 'string',
'DisplayName': 'string',
'CreatedTime': datetime(2015, 1, 1),
'StorageConnectors': [
{
'ConnectorType': 'HOMEFOLDERS'|'GOOGLE_DRIVE'|'ONE_DRIVE',
'ResourceIdentifier': 'string',
'Domains': [
'string',
],
'DomainsRequireAdminConsent': [
'string',
]
},
],
'RedirectURL': 'string',
'FeedbackURL': 'string',
'StackErrors': [
{
'ErrorCode': 'STORAGE_CONNECTOR_ERROR'|'INTERNAL_SERVICE_ERROR',
'ErrorMessage': 'string'
},
],
'UserSettings': [
{
'Action': 'CLIPBOARD_COPY_FROM_LOCAL_DEVICE'|'CLIPBOARD_COPY_TO_LOCAL_DEVICE'|'FILE_UPLOAD'|'FILE_DOWNLOAD'|'PRINTING_TO_LOCAL_DEVICE'|'DOMAIN_PASSWORD_SIGNIN'|'DOMAIN_SMART_CARD_SIGNIN'|'AUTO_TIME_ZONE_REDIRECTION',
'Permission': 'ENABLED'|'DISABLED',
'MaximumLength': 123
},
],
'ApplicationSettings': {
'Enabled': True|False,
'SettingsGroup': 'string',
'S3BucketName': 'string'
},
'AccessEndpoints': [
{
'EndpointType': 'STREAMING',
'VpceId': 'string'
},
],
'EmbedHostDomains': [
'string',
],
'StreamingExperienceSettings': {
'PreferredProtocol': 'TCP'|'UDP'
},
'ContentRedirection': {
'HostToClient': {
'Enabled': True|False,
'AllowedUrls': [
'string',
],
'DeniedUrls': [
'string',
]
}
},
'AgentAccessConfig': {
'Settings': [
{
'AgentAction': 'COMPUTER_VISION'|'COMPUTER_INPUT'|'FORWARD_MCP_TOOLS',
'Permission': 'ENABLED'|'DISABLED'
},
],
'S3BucketArn': 'string',
'ScreenshotsUploadEnabled': True|False,
'ReplaySessionEnabled': True|False,
'KmsKeyArn': 'string',
'ScreenResolution': 'W_1280xH_720',
'ScreenImageFormat': 'PNG'|'JPEG',
'UserControlMode': 'VIEW_ONLY'|'VIEW_STOP'|'DISABLED'
},
'StorageConnectorAuthentication': 'FORCE_REAUTHENTICATION'|'REUSE_CREDENTIALS'
}
}
Response Structure
(dict) --
Stack (dict) --
Information about the stack.
Arn (string) --
The ARN of the stack.
Name (string) --
The name of the stack.
Description (string) --
The description to display.
DisplayName (string) --
The stack name to display.
CreatedTime (datetime) --
The time the stack was created.
StorageConnectors (list) --
The storage connectors to enable.
(dict) --
Describes a connector that enables persistent storage for users.
ConnectorType (string) --
The type of storage connector.
ResourceIdentifier (string) --
The ARN of the storage connector.
Domains (list) --
The names of the domains for the account.
(string) -- GSuite domain for GDrive integration.
DomainsRequireAdminConsent (list) --
The OneDrive for Business domains where you require admin consent when users try to link their OneDrive account to WorkSpaces Applications. The attribute can only be specified when ConnectorType=ONE_DRIVE.
(string) -- GSuite domain for GDrive integration.
RedirectURL (string) --
The URL that users are redirected to after their streaming session ends.
FeedbackURL (string) --
The URL that users are redirected to after they click the Send Feedback link. If no URL is specified, no Send Feedback link is displayed.
StackErrors (list) --
The errors for the stack.
(dict) --
Describes a stack error.
ErrorCode (string) --
The error code.
ErrorMessage (string) --
The error message.
UserSettings (list) --
The actions that are enabled or disabled for users during their streaming sessions. By default these actions are enabled.
(dict) --
Describes an action and whether the action is enabled or disabled for users during their streaming sessions.
Action (string) --
The action that is enabled or disabled.
Permission (string) --
Indicates whether the action is enabled or disabled.
MaximumLength (integer) --
Specifies the number of characters that can be copied by end users from the local device to the remote session, and to the local device from the remote session.
This can be specified only for the CLIPBOARD_COPY_FROM_LOCAL_DEVICE and CLIPBOARD_COPY_TO_LOCAL_DEVICE actions.
This defaults to 20,971,520 (20 MB) when unspecified and the permission is ENABLED. This can't be specified when the permission is DISABLED.
The value can be between 1 and 20,971,520 (20 MB).
ApplicationSettings (dict) --
The persistent application settings for users of the stack.
Enabled (boolean) --
Specifies whether persistent application settings are enabled for users during their streaming sessions.
SettingsGroup (string) --
The path prefix for the S3 bucket where users’ persistent application settings are stored.
S3BucketName (string) --
The S3 bucket where users’ persistent application settings are stored. When persistent application settings are enabled for the first time for an account in an AWS Region, an S3 bucket is created. The bucket is unique to the AWS account and the Region.
AccessEndpoints (list) --
The list of virtual private cloud (VPC) interface endpoint objects. Users of the stack can connect to WorkSpaces Applications only through the specified endpoints.
(dict) --
Describes an interface VPC endpoint (interface endpoint) that lets you create a private connection between the virtual private cloud (VPC) that you specify and WorkSpaces Applications. When you specify an interface endpoint for a stack, users of the stack can connect to WorkSpaces Applications only through that endpoint. When you specify an interface endpoint for an image builder, administrators can connect to the image builder only through that endpoint.
EndpointType (string) --
The type of interface endpoint.
VpceId (string) --
The identifier (ID) of the VPC in which the interface endpoint is used.
EmbedHostDomains (list) --
The domains where WorkSpaces Applications streaming sessions can be embedded in an iframe. You must approve the domains that you want to host embedded WorkSpaces Applications streaming sessions.
(string) -- Specifies a valid domain that can embed AppStream. Valid examples include: ["testorigin.tt--com", "testingorigin.com.us", "test.com.us"] Invalid examples include: ["test,com", ".com", "h*llo.com". ""]
StreamingExperienceSettings (dict) --
The streaming protocol you want your stack to prefer. This can be UDP or TCP. Currently, UDP is only supported in the Windows native client.
PreferredProtocol (string) --
The preferred protocol that you want to use while streaming your application.
ContentRedirection (dict) --
Configuration for bidirectional URL redirection between the streaming session and the local client. Use HostToClient to redirect URLs from the remote desktop to the local browser.
HostToClient (dict) --
Configuration for redirecting URLs from the remote desktop to the local client browser.
Enabled (boolean) --
Whether URL redirection is enabled for this direction.
AllowedUrls (list) --
List of URL patterns that are allowed to be redirected. URLs matching these patterns will be redirected unless they also match a pattern in the denied list.
(string) --
A glob pattern using wildcards (* for zero or more characters, ? for exactly one character) to match URLs for redirection rules. Patterns do not include a protocol prefix; HTTPS is enforced automatically. Valid examples: , *.example.com, github.com/myorg/, api?.example.com Invalid examples: https://example.com (no protocol), empty string
DeniedUrls (list) --
List of URL patterns that are denied from redirection. This list takes precedence over the allowed list.
(string) --
A glob pattern using wildcards (* for zero or more characters, ? for exactly one character) to match URLs for redirection rules. Patterns do not include a protocol prefix; HTTPS is enforced automatically. Valid examples: , *.example.com, github.com/myorg/, api?.example.com Invalid examples: https://example.com (no protocol), empty string
AgentAccessConfig (dict) --
The agent access configuration of the stack, if agent access is enabled.
Settings (list) --
The list of agent access settings that define permissions for each agent action. You must specify at least one setting, and at least one agent action must be enabled.
(dict) --
A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled.
AgentAction (string) --
The agent action to configure. Valid values are COMPUTER_VISION, COMPUTER_INPUT, and FORWARD_MCP_TOOLS. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION.
Permission (string) --
Whether the agent action is enabled or disabled.
S3BucketArn (string) --
The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots and Replay Session artifacts are stored. Required when ScreenshotsUploadEnabled or ReplaySessionEnabled is true.
ScreenshotsUploadEnabled (boolean) --
Indicates whether screenshot uploads to Amazon S3 are enabled for agent sessions.
ReplaySessionEnabled (boolean) --
Indicates whether Replay Session is enabled for agent sessions. WorkSpaces Applications delivers a video combining session screenshots, a transcript, and a report for each session. Requires the COMPUTER_VISION agent action.
KmsKeyArn (string) --
The Amazon Resource Name (ARN) of the customer managed symmetric encryption KMS key that encrypts Replay Session artifacts while WorkSpaces Applications processes them. The key must be in the same Region as the stack, and ReplaySessionEnabled must be true.
ScreenResolution (string) --
The screen resolution for the agent streaming environment.
ScreenImageFormat (string) --
The image format for agent screen captures.
UserControlMode (string) --
The user control mode for agent sessions. This setting determines how users can interact with agent sessions.
StorageConnectorAuthentication (string) --
Indicates whether users' cloud storage authentication persists across streaming sessions. When this attribute is FORCE_REAUTHENTICATION, WorkSpaces Applications removes the stored authentication for the stack's OneDrive and Google Drive connectors when a user's session ends. The user links their cloud storage again on their next session. The default is REUSE_CREDENTIALS.