A company needs a cloud-based, managed desktop solution for its workforce of remote employees. The company wants to ensure that the employees can…

Amazon WorkSpaces is a managed, secure Desktop-as-a-Service (DaaS) solution that directly meets the need for a cloud-based, managed desktop. To ensure access is restricted to company-provided devices, WorkSpaces supports certificate-based access control. By creating a private certificate authority (CA), issuing client certificates to trusted corporate devices, and enabling access control at the directory level, the service will only allow connections from clients that present a valid certificate. This approach effectively binds access to specific, trusted hardware, fulfilling the core security requirement while leveraging a managed service to minimize cost and operational overhead.

A. A custom VDI solution incurs significant management overhead and cost, contradicting the requirements to minimize both. Amazon WorkSpaces is the appropriate managed service.

B. Using individual EC2 instances is not a managed desktop solution. It requires extensive self-management, increasing both complexity and cost, which violates the prompt's constraints.

C. IP blocking restricts access based on network location (IP address), not the specific device. A user on an untrusted device could gain access if they are on a trusted network (e.g., corporate VPN).

1. AWS Documentation: Amazon WorkSpaces Administration Guide, "Restrict WorkSpaces access to trusted devices."

This document explicitly states: "You can restrict Amazon WorkSpaces access to trusted devices only. You can do this by using digital certificates to control access to your WorkSpaces." It details the process of using a root certificate on the directory and client certificates on devices, which directly supports the solution in option D.

2. AWS Documentation: Amazon WorkSpaces Administration Guide, "Prerequisites for restricting WorkSpaces access to trusted devices."

This section outlines the need for a root certificate and client certificates issued by the same certificate authority (CA). It confirms that the mechanism involves deploying these certificates to the directory and trusted client devices, respectively.

3. AWS Documentation: Amazon WorkSpaces Administration Guide, "Enable device trust for WorkSpaces."

This guide provides the step-by-step procedure, stating in Step 1: "In the Amazon WorkSpaces console navigation pane, choose Directories. Select your directory and choose Actions, Update Details." This confirms that the restriction is enabled at the directory level.

4. AWS Documentation: Amazon WorkSpaces Administration Guide, "IP access control groups for your WorkSpaces."

This document clarifies the function of IP-based controls: "IP access control groups act as a virtual firewall that controls the IP addresses from which users are allowed to access their WorkSpaces." This confirms that IP blocking (Option C) is for network-level, not device-level, trust.