Amazon WorkSpaces Secure Browser will no longer be open to new customers starting October 29, 2026. If you would like to use Amazon WorkSpaces Secure Browser, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon WorkSpaces Secure Browser availability change](https://docs.aws.amazon.com/workspaces-web/latest/adminguide/workspaces-secure-browser-maintenance-mode.html). 

# Service-linked role permissions for WorkSpaces Secure Browser
<a name="slr-permissions"></a>

WorkSpaces Secure Browser uses the service-linked role named `AWSServiceRoleForAmazonWorkSpacesWeb` – WorkSpaces Secure Browser uses this service-linked role to access Amazon EC2 resources of customer accounts for streaming instances and CloudWatch metrics.

The `AWSServiceRoleForAmazonWorkSpacesWeb` service-linked role trusts the following services to assume the role:
+ `workspaces-web.amazonaws.com`

The role permissions policy named `AmazonWorkSpacesWebServiceRolePolicy` allows WorkSpaces Secure Browser to complete the following actions on the specified resources. For more information, see [AWS managed policy: AmazonWorkSpacesWebServiceRolePolicy](security-iam-awsmanpol-AmazonWorkSpacesWebServiceRolePolicy.md).
+ Action: `ec2:DescribeVpcs` on `all AWS resources`
+ Action: `ec2:DescribeSubnets` on `all AWS resources`
+ Action: `ec2:DescribeAvailabilityZones` on `all AWS resources`
+ Action: `ec2:CreateNetworkInterface` with `aws:RequestTag/WorkSpacesWebManaged: true` on subnet and security group resources
+ Action: `ec2:DescribeNetworkInterfaces` on `all AWS resources`
+ Action: `ec2:DeleteNetworkInterface` on  network interfaces with `aws:ResourceTag/WorkSpacesWebManaged: true`
+ Action: `ec2:DescribeSubnets` on `all AWS resources`
+ Action: `ec2:AssociateAddress` on `all AWS resources`
+ Action: `ec2:DisassociateAddress` on `all AWS resources`
+ Action: `ec2:DescribeRouteTables` on `all AWS resources`
+ Action: `ec2:DescribeSecurityGroups` on `all AWS resources`
+ Action: `ec2:DescribeVpcEndpoints` on `all AWS resources`
+ Action: `ec2:CreateTags` on `ec2:CreateNetworkInterface` Operation with `aws:TagKeys: ["WorkSpacesWebManaged"]`
+ Action: `cloudwatch:PutMetricData` on `all AWS resources`
+ Action: `kinesis:PutRecord` on Kinesis data streams with names that start with `amazon-workspaces-web-`
+ Action: `kinesis:PutRecords` on Kinesis data streams with names that start with `amazon-workspaces-web-`
+ Action: `kinesis:DescribeStreamSummary` on Kinesis data streams with names that start with `amazon-workspaces-web-`

You must configure permissions to allow an IAM entity (such as a user, group, or role) to create, edit, or delete a service-linked role. For more information, see [Service-Linked Role Permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions) in the *IAM User Guide*.