Amazon Workspaces tip for Windows 10/11 BYOL Image Import can save days of troubleshooting

Amazon WorkSpaces is a managed, secure Desktop-as-a-Service (DaaS) solution that allows you to provision virtual, cloud-based Microsoft Windows or Amazon Linux desktops for your users. With Amazon WorkSpaces, you can bring your own Windows 10/11 license (BYOL) and deploy it on WorkSpaces, providing a consistent experience for your users. There are several excellent articles and resources that detail the BYOL import process, such as Best practices for successful BYOL image creation for Amazon WorkSpaces and this video Create an Amazon WorkSpaces Bring Your Own License (BYOL) image with VMware Workstation. This guide I want to focus on the encryption requirements and configurations, which is often overlooked and is an essential step to ensure a successful import of your Windows 10/11 BYOL image.

I recently helped a customer, who had reviewed all the documentation and resources outlined in above, yet they encountered an encryption error while trying to import the image into Amazon WorkSpaces. They had tried and doubled check the process and was not able to resolve. This error caused a blocker and delayed their Windows 10/11 BYOL image import for several days.

As documented in the detailed BYOL import requirements, Amazon WorkSpaces Documentation, Encrypted AMIs are not supported in the importing process. Ensure you disable the instance used to create the EC2 AMI has EBS encryption. Encryption can be enabled after the final WorkSpaces is provisioned. This is often overlooked because EC2 AMI EBS encryption could be enabled by default at the AWS account level. When the customer took this recommendation, they were able to resolve the import encryption error.

Here's a list of other areas to check for Encryption during an Amazon WorkSpaces BYOL image import.

Before exporting your Windows 11 image, ensure that Windows BitLocker is disabled. BitLocker encryption can interfere with the VMImport process, causing errors during the import. To disable BitLocker:

Verify that all volumes and drives are not encrypted before exporting the image. This step is crucial to avoid any encryption-related issues during the import process.

When uploading your image to Amazon S3, you can use server-side encryption to store the image securely. This ensures that your data is protected while it resides in S3. To enable server-side encryption:

Amazon EC2 EBS (Elastic Block Store) encryption is an account and region-wide configuration. If EBS encryption is enabled by default, it can cause issues during the VMImport process. To disable EBS encryption:

Once the VMImport process is completed, you can re-enable EBS encryption to ensure your data remains secure. To re-enable EBS encryption:

By following these best practices, you can ensure a smooth and successful import of your Windows 11 BYOL image into Amazon WorkSpaces. If you encounter any issues, consider consulting the detailed Amazon WorkSpaces Documentation.