End-user computing and contact centers
Choosing between WorkSpaces, WorkSpaces Applications (formerly AppStream 2.0) and WorkSpaces Secure Browser, and building a contact center on Amazon Connect with Lex, Polly, Transcribe and Contact Lens.
Exam tasks: 2.1 (design a deployment strategy for business requirements: remote users, customer engagement)
The decision: do users need a whole desktop that keeps their state, a few applications streamed to any device, or just safe access to internal web apps? And for customer calls and chats, how much can a bot handle before an agent takes over?
Choosing an end-user service
Side by side
| WorkSpaces (personal) | WorkSpaces Applications | WorkSpaces Secure Browser | |
|---|---|---|---|
| Delivers | A full, persistent Windows or Linux desktop | Individual apps streamed to a browser or client | A disposable, isolated web browser |
| State | Persistent root and user volumes | Non-persistent instances; home folders and app settings saved to S3 | None: container discarded after the session |
| Mapping | One desktop per user | Fleet instances shared over time | Session per user |
| Billing | Monthly or hourly (AutoStop) per desktop | Per streaming instance-hour, plus user fees | Per active user per month |
| Good for | Knowledge workers, contractors, BYOD with full desktop needs | Training labs, one CAD or GPU app for many users, SaaS delivery of desktop apps | Contractors reaching internal wikis and SaaS with no data on the device |
Legacy: use Amazon WorkSpaces Applications instead
Amazon AppStream 2.0 was renamed to Amazon WorkSpaces Applications. It's the same service and API, so older questions that say AppStream 2.0 mean application streaming. Likewise, WorkSpaces Web was renamed WorkSpaces Secure Browser in 2024.
WorkSpaces
- Running modes: AlwaysOn bills a monthly fee and suits full-time users. AutoStop bills hourly and stops after a period of inactivity, which suits part-time users. Compare them with usage data to cut cost.
- Directory: WorkSpaces registers with AWS Managed Microsoft AD, or with an AD Connector that proxies to your on-premises Active Directory, so users sign in with existing credentials. Simple AD is in maintenance for new customers.
- Protocols: Amazon DCV (formerly WSP) is the current streaming protocol and supports browser access. The PCoIP protocol and WorkSpaces Pools are in sunset, with support ending June 2027.
- Security controls: IP access control groups restrict where users connect from. Trusted device certificates limit access to managed devices. MFA through RADIUS on the directory. Volumes can be encrypted with KMS.
- BYOL: bring eligible Windows licenses on dedicated hardware for large deployments.
- Networking: desktops live in your VPC subnets (two AZs), so they reach on-premises through Direct Connect or VPN like any other VPC resource.
Exam signal
"Contractors need a secure desktop, data must not leave AWS, and they use their own laptops" points to WorkSpaces with clipboard and drive redirection turned off. "Only an intranet site and a SaaS app" points to WorkSpaces Secure Browser, which is cheaper and simpler.
WorkSpaces Applications
- Image builder: install apps once and create an image. Fleets launch from that image.
- Fleet types: Always-on (instant session start), On-demand (cheaper, a short wait while the instance starts), and Elastic (AWS manages capacity, apps delivered from app blocks).
- Scaling: fleet auto scaling on capacity utilization or a schedule, for example before a training class.
- Identity: a built-in user pool for small groups, or SAML 2.0 federation for production.
- Persistence: home folders in S3 and application settings persistence keep user data between sessions even though instances are discarded.
- Graphics-intensive instance families are available for 3D, CAD and video apps.
A desktop for everyone
If users need one or two applications, provisioning a full WorkSpace each wastes money and patching effort. Application streaming serves many users from a shared, non-persistent fleet.
Amazon Connect contact centers
| Service | Role in the contact center |
|---|---|
| Amazon Connect | Cloud contact center: phone numbers, chat, tasks, contact flows, queues, routing, agent workspace. Pay per use, no hardware |
| Amazon Lex | Conversational bots for voice (IVR) and chat. Intents and slots, fulfilled by Lambda |
| Amazon Polly | Text to speech for prompts and bot responses, with neural voices and SSML |
| Amazon Transcribe | Speech to text, with call analytics and PII redaction |
| Contact Lens | Connect's built-in analytics: transcripts, sentiment, keyword and category rules, real-time supervisor alerts, PII redaction |
| Amazon Comprehend | Custom text analysis on exported transcripts when Contact Lens rules aren't enough |
- Contact flows decide what happens to each contact: play a prompt, invoke a Lex bot, call Lambda to look up the customer, set queue and priority, and transfer.
- Lambda in flows reaches back-end systems (CRM, order database) for self-service answers such as order status.
- Customer Profiles give agents a unified view of the caller from connected sources.
- Call recordings and Contact Lens output land in S3, where Athena and QuickSight can report on them.
- Use Lex V2. Lex V1 reached end of support in 2025.
Exam signal
"Reduce agent load with self-service" means Lex in a Connect flow. "Detect frustrated customers and alert supervisors in real time" means Contact Lens real-time analytics. "Natural-sounding spoken prompts from dynamic text" means Polly.
Legacy: use Amazon S3 or a third-party document collaboration service instead
Amazon WorkDocs reached end of support in April 2025, and its data was deleted after that date. It was the answer for managed document storage, sharing and feedback. Don't pick it for a new design.
Scenarios
Streaming one application from a shared, auto-scaled GPU fleet fits part-time use of a single app, and settings persistence plus home folders keep user state without persistent machines. AlwaysOn WorkSpaces bill monthly for each of 400 desktops. Secure Browser only delivers web apps. Per-contractor EC2 instances cost more and Session Manager isn't a graphical desktop.
Lex understands the spoken request and Lambda fetches the booking, Polly speaks the answer, and Contact Lens gives sentiment across calls. The flow transfers to a queue when the bot can't resolve the request. Rekognition analyzes images, not voice calls. Sending transcripts by SMS doesn't address any stated requirement.
Further reading
Analytics patterns
Building an S3 data lake with Glue, Athena and Lake Formation, and choosing between Athena, Redshift, EMR and OpenSearch, with Firehose ingestion, QuickSight dashboards and AppSync as a GraphQL layer.
Pricing models
On-Demand, Reserved Instances, Savings Plans, Spot and Capacity Reservations for compute, S3 storage classes and lifecycle, and how to model data transfer costs.