Workspaces on ferkakta.dev

Amazon WorkSpaces are invisible to SSM and CloudWatch (and how to fix it)

Thu, 12 Feb 2026 10:00:00 -0600

I spent an afternoon arguing with Windows about whether I was allowed to be root on a machine I created. Six hours and six layers of undocumented workarounds later, I got CMMC-compliant audit logging on a desktop that doesn’t know it exists.

The problem

WorkSpaces don’t show up in AWS Systems Manager. They’re not EC2 instances — no instance profile, no metadata endpoint, no identity. SSM Agent is pre-installed but thinks it’s nobody. CloudWatch Agent has no credentials and doesn’t know what region it’s in.

SimpleAD is Samba 4 — you can create users with ldapadd instead of ClickOps

Thu, 12 Feb 2026 09:00:00 -0600

If you’ve tried to fully automate Amazon WorkSpaces provisioning with Terraform, you’ve hit the wall: SimpleAD has no AWS API for creating directory users.

What every guide tells you

Enable WorkDocs in the console, then use the WorkDocs API to create users
Launch a domain-joined EC2 instance with RSAT tools and create users manually
RDP into a Windows management machine and use the AD admin console

All of these break the Terraform workflow. Everything is automated except the one step that creates the user your WorkSpace actually needs.