# AWS WorkSpaces connector

{% hint style="warning" %}
This documentation references external sources. Nexthink does not have control over the accuracy of third-party documentation, nor any external updates or changes that might create inconsistencies with the information presented on this page. Please report any errors or inconsistencies to [Nexthink Support](https://support.nexthink.com/).
{% endhint %}

The Nexthink Connector for AWS WorkSpaces retrieves essential information about your AWS WorkSpaces virtual desktop infrastructure (VDI). The connector enriches your Nexthink environment with AWS WorkSpaces data that enhances visibility into VDI health, usage patterns, and configuration drift.

This installation guide is designed to help you securely deploy the connector for AWS. We recommend that your organization’s security team reviews the configuration and installation steps outlined here and adjusts them as needed to align with internal security policies and compliance requirements.

## Device fields <a href="#device-fields" id="device-fields"></a>

The connector for AWS WorkSpaces enriches the following device virtualization fields:

| Field                            | Description                                                                                                                                           |
| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| Virtualization desktop pool name | Hardware characteristics of the associated VMs.                                                                                                       |
| Virtualization desktop pool type | <p>Possible values:</p><ul><li>personal</li><li>pooled</li></ul>                                                                                      |
| Virtualization hostname          | <p>This field is enriched if the machines are hosted by a vendor in the cloud.</p><p>Default value: <code>AWS host</code></p>                         |
| Virtualization hypervisor name   | <p>Type of hardware virtualization system being used.</p><p>Defaults value: <code>AWS hypervisor</code></p>                                           |
| Environment name                 | Name of the connector instance which enriches the virtual device.                                                                                     |
| Desktop broker                   | <p>Name of the desktop virtualization product being used.</p><p>Defaults value: <code>aws\_workspaces</code></p>                                      |
| Disk image                       | Name of the disk image used to deploy the VM.                                                                                                         |
| Instance size                    | The hardware configuration (vCPU, memory, and GPU resources) assigned to a VM. This field displays one of the predefined AWS values for compute type. |
| Region                           | AWS WorkSpaces region.                                                                                                                                |
| Last update                      | The last time the device fields were updated.                                                                                                         |

## Configure connector credentials

To allow Nexthink to export data to your AWS WorkSpaces connector, you must first configure the [connector credentials](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/integrating-nexthink-with-third-party-tools/outbound-connectors/connector-credentials) by completing the following steps:

{% stepper %}
{% step %}
Select **Administration** > **Connector credentials** in the main menu.
{% endstep %}

{% step %}
Select **New credential** in the top-right corner of the **Connector credentials** page.
{% endstep %}

{% step %}
Fill in the credential configuration input fields:

* **Name**: The unique name of the credential.
* **Protocol**: Select `AWS IAM`.

The configuration screen should look as follows:

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-f8748348511a6dfc1c071ea0973319021d0db0a0%2FUntitled%20(7).png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="info" %}
Nexthink generates the **AWS External ID** automatically. You will use it in the next steps to create the AWS Role and retrieve its Amazon Resource Name (ARN). You can then paste this ARN in the **AWS Role ARN** text box.

Nexthink uses the recommended procedure from AWS for third-party access as described in the [Access to AWS accounts owned by third parties](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html) documentation.
{% endhint %}
{% endstep %}

{% step %}
Sign in to AWS and create an IAM role. The following code example shows the minimum level of access required by the Nexthink AWS WorkSpaces connector:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DescribeWorkspacesInfo",
            "Effect": "Allow",
            "Action": [
                "workspaces:DescribeWorkspaceImages",
                "workspaces:DescribeWorkspacesPoolSessions",
                "workspaces:DescribeWorkspacesPools",
                "workspaces:DescribeWorkspaceBundles",
                "workspaces:DescribeWorkspaces"
            ],
            "Resource": "*"
        }
    ]
}
```

{% endstep %}

{% step %}
Create an IAM role that gives Nexthink access:

* **Name**: The role name must start with the prefix `NexthinkConnector-`.
* **Permissions**: Add the policy created above.
* **Trusted Policies**: The trust policy must specify the following AWS account number of Nexthink as `Principal`: `884848470805`\
  Furthermore, add a `Condition` element to the trust policy that will test whether the `ExternalId` matches the generated external ID provided in the form above. The following code is an example of the trust relationship in the role:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::884848470805:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": <EXTERNAL_ID>
                }
            }
        }
    ]
}
```

{% hint style="warning" %}
Replace `<EXTERNAL_ID>` with the AWS External ID field generated in the credential form.
{% endhint %}
{% endstep %}

{% step %}
After creating the role, copy its AWS Role ARN:

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-ffbcd477e778dfac27d83afda9bc3be310abbf82%2Faws-arn.png?alt=media" alt="Copying the AWS Role ARN"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
In Nexthink, on the **Connector credentials** page, edit the AWS Credentials, and insert the ARN in the **AWS Role ARN** text box in **Credential details**, and select **Save**:

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-54197f066a11330658e63193a12195372893f4f2%2FUntitled.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

## Configure the AWS WorkSpaces connector <a href="#configure-the-aws-workspaces-connector" id="configure-the-aws-workspaces-connector"></a>

Ensure you [configured the connector credentials](#configure-connector-credentials), then create a new connector:

1. Go to **Administration** > **Inbound connectors**.
2. Select **New connector** in the top-right corner of the page.
3. Select **AWS WorkSpaces** from the connector list.

The following sections explain how to configure the connector.

### General tab

* **Name**: Add a meaningful name for the connector. This name appears on the administration page.
* **NQL ID**: Add a unique identifier for the connector used when referencing the AWS WorkSpaces connector in NQL queries. You can initially modify the suggested NQL ID, but after saving the workflow, you can no longer change it.
* **Description**: Add a short description of the purpose and behavior of the connector.

#### Schedule

* **Recurrence**: Select how often the connector should run.

#### Connection

* **Credentials**: Select preconfigured credentials from the Connector credentials page. Only AWS IAM is supported.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-3081dbea3045c1f14ed6c196da4834e84ee9d5da%2FUntitled.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

### Parameters tab

* **Region**: Select the AWS region where the workspaces are located. It needs to be a valid AWS region, such as `us-east-1`.
* **Environment name**: A custom-defined text. The enriched virtual devices will have a reference to this environment name in NQL.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-772d2f44b0cfd1f491fa6fdd7821997fa588e082%2FUntitled%20(10).png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

## Test results panel

{% hint style="info" %}
The **Test results** panel is available only for supported connectors. Connector availability also depends on your license.
{% endhint %}

Use the **Test results** panel on the right side to run the connector with real data on demand, and inspect responses and errors. The test panel helps with faster debugging and validation during setup, and also with more reliable mappings with less trial and error.

Select the **Run test** button to call the API, and validate the credentials and check connectivity to the targeted endpoint.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2FzRovTkerdIw546arid2w%2Fimage.png?alt=media&#x26;token=f907c407-422b-409c-af79-fa4a40029b00" alt=""><figcaption></figcaption></figure>

Besides basic information, such as the response status code and time, the panel also shows a sample record of the response at the bottom.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2FI4IxueEsH60Pl3NQpjF0%2FHwklwWjD3Ud5ZXPC.png?alt=media&#x26;token=85b6123d-b40e-4085-871e-bc17232c8a15" alt="" width="316"><figcaption></figcaption></figure>

In the event of an error, the system displays the API response to aid in diagnosing the issue.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2FKwqz92TxPeBl3QWqbKNt%2F9kAwIQi3M5gG7Y0H.png?alt=media&#x26;token=eeb306f0-d2b8-441b-a105-1bcd708a2d7c" alt="" width="309"><figcaption></figcaption></figure>

Note: For AWS workspaces you may encounter [rate limits ](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-limits.html)being applied, which could fail the connection test. We advise to run it several times or if possible, one region at a time.