This resource specifies browser settings that can be associated with a web portal.

Once associated with a web portal, browser settings control how the browser will behave once a user starts a streaming session for the web portal.

CfnBrowserSettings

Additional encryption context of the browser settings.

additionalEncryptionContext

A JSON string containing Chrome Enterprise policies that will be applied to all streaming sessions.

browserPolicy

The custom managed key of the browser settings.

*Pattern* : `^arn:[\w+=\/,.@-]+:kms:[a-zA-Z0-9\-]*:[a-zA-Z0-9]{1,12}:key\/[a-zA-Z0-9-]+$`

customerManagedKey

The tags to add to the browser settings resource.

A tag is a key-value pair.

webContentFilteringPolicy

The data protection settings resource that can be associated with a web portal.

CfnDataProtectionSettings

The additional encryption context of the data protection settings.

The customer managed key used to encrypt sensitive information in the data protection settings.

The description of the data protection settings.

description

The display name of the data protection settings.

displayName

The inline redaction configuration for the data protection settings.

inlineRedactionConfiguration

The tags of the data protection settings.

This resource specifies an identity provider that is then associated with a web portal.

This resource is not required if your portal's `AuthenticationType` is IAM Identity Center.

CfnIdentityProvider

The identity provider details. The following list describes the provider detail keys for each identity provider type.

- For Google and Login with Amazon:

- `client_id`
- `client_secret`
- `authorize_scopes`
- For Facebook:

- `client_id`
- `client_secret`
- `authorize_scopes`
- `api_version`
- For Sign in with Apple:

- `client_id`
- `team_id`
- `key_id`
- `private_key`
- `authorize_scopes`
- For OIDC providers:

- `client_id`
- `client_secret`
- `attributes_request_method`
- `oidc_issuer`
- `authorize_scopes`
- `authorize_url` *if not available from discovery URL specified by oidc_issuer key*
- `token_url` *if not available from discovery URL specified by oidc_issuer key*
- `attributes_url` *if not available from discovery URL specified by oidc_issuer key*
- `jwks_uri` *if not available from discovery URL specified by oidc_issuer key*
- For SAML providers:

- `MetadataFile` OR `MetadataURL`
- `IDPSignout` (boolean) *optional*
- `IDPInit` (boolean) *optional*
- `RequestSigningAlgorithm` (string) *optional* - Only accepts `rsa-sha256`
- `EncryptedResponses` (boolean) *optional*

identityProviderDetails

identityProviderName

identityProviderType

portalArn

This resource specifies IP access settings that can be associated with a web portal.

For more information, see [Set up IP access controls (optional)](https://docs.aws.amazon.com/workspaces-web/latest/adminguide/ip-access-controls.html) .

CfnIpAccessSettings

ipRules

Additional encryption context of the IP access settings.

The custom managed key of the IP access settings.

*Pattern* : `^arn:[\w+=\/,.@-]+:kms:[a-zA-Z0-9\-]*:[a-zA-Z0-9]{1,12}:key\/[a-zA-Z0-9-]+$`

The description of the IP access settings.

The display name of the IP access settings.

The tags to add to the IP access settings resource.

A tag is a key-value pair.

This resource specifies network settings that can be associated with a web portal.

Once associated with a web portal, network settings define how streaming instances will connect with your specified VPC.

The VPC must have default tenancy. VPCs with dedicated tenancy are not supported.

For availability consideration, you must have at least two subnets created in two different Availability Zones. WorkSpaces Secure Browser is available in a subset of the Availability Zones for each supported Region. For more information, see [Supported Availability Zones](https://docs.aws.amazon.com/workspaces-web/latest/adminguide/availability-zones.html) .

CfnNetworkSettings

One or more security groups used to control access from streaming instances to your VPC.

*Pattern* : `^[\w+\-]+$`

securityGroupIds

The subnets in which network interfaces are created to connect streaming instances to your VPC.

At least two of these subnets must be in different availability zones.

*Pattern* : `^subnet-([0-9a-f]{8}|[0-9a-f]{17})$`

subnetIds

The VPC that streaming instances will connect to.

*Pattern* : `^vpc-[0-9a-z]*$`

vpcId

The tags to add to the network settings resource.

A tag is a key-value pair.

This resource specifies a web portal, which users use to start browsing sessions.

A `Standard` web portal can't start browsing sessions unless you have at defined and associated an `IdentityProvider` and `NetworkSettings` resource. An `IAM Identity Center` web portal does not require an `IdentityProvider` resource.

For more information about web portals, see [What is Amazon WorkSpaces Secure Browser?](https://docs.aws.amazon.com/workspaces-web/latest/adminguide/what-is-workspaces-web.html.html) .

CfnPortal

The additional encryption context of the portal.

The type of authentication integration points used when signing into the web portal. Defaults to `Standard` .

`Standard` web portals are authenticated directly through your identity provider (IdP). User and group access to your web portal is controlled through your IdP. You need to include an IdP resource in your template to integrate your IdP with your web portal. Completing the configuration for your IdP requires exchanging WorkSpaces Secure Browser’s SP metadata with your IdP’s IdP metadata. If your IdP requires the SP metadata first before returning the IdP metadata, you should follow these steps:

1. Create and deploy a CloudFormation template with a `Standard` portal with no `IdentityProvider` resource.

2. Retrieve the SP metadata using `Fn:GetAtt` , the WorkSpaces Secure Browser console, or by the calling the `GetPortalServiceProviderMetadata` API.

3. Submit the data to your IdP.

4. Add an `IdentityProvider` resource to your CloudFormation template.

`SSO` web portals are authenticated through SSOlong . They provide additional features, such as IdP-initiated authentication. Identity sources (including external identity provider integration) and other identity provider information must be configured in SSO . User and group assignment must be done through the WorkSpaces Secure Browser console. These cannot be configured in CloudFormation.

authenticationType

The ARN of the browser settings that is associated with this web portal.

browserSettingsArn

The customer managed key of the web portal.

*Pattern* : `^arn:[\w+=\/,.@-]+:kms:[a-zA-Z0-9\-]*:[a-zA-Z0-9]{1,12}:key\/[a-zA-Z0-9-]+$`

dataProtectionSettingsArn

The type and resources of the underlying instance.

instanceType

The ARN of the IP access settings that is associated with the web portal.

ipAccessSettingsArn

The maximum number of concurrent sessions for the portal.

maxConcurrentSessions

The ARN of the network settings that is associated with the web portal.

networkSettingsArn

portalCustomDomain

The ARN of the session logger that is associated with the portal.

sessionLoggerArn

The tags to add to the web portal.

A tag is a key-value pair.

The ARN of the trust store that is associated with the web portal.

trustStoreArn

The ARN of the user access logging settings that is associated with the web portal.

userAccessLoggingSettingsArn

The ARN of the user settings that is associated with the web portal.

userSettingsArn

CfnSessionLogger

The filter that specifies which events to monitor.

eventFilter

The configuration that specifies where logs are fowarded.

logConfiguration

The additional encryption context of the session logger.

The custom managed key of the session logger.

This resource specifies a trust store that can be associated with a web portal.

A trust store contains certificate authority (CA) certificates. Once associated with a web portal, the browser in a streaming session will recognize certificates that have been issued using any of the CAs in the trust store. If your organization has internal websites that use certificates issued by private CAs, you should add the private CA certificate to the trust store.

CfnTrustStore

A list of CA certificates to be added to the trust store.

certificateList

The tags to add to the trust store.

A tag is a key-value pair.

This resource specifies user access logging settings that can be associated with a web portal.

In order to receive logs from WorkSpaces Secure Browser, you must have an Amazon Kinesis Data Stream that starts with "amazon-workspaces-web-*". Your Amazon Kinesis data stream must either have server-side encryption turned off, or must use AWS managed keys for server-side encryption.

For more information about setting server-side encryption in Amazon Kinesis , see [How Do I Get Started with Server-Side Encryption?](https://docs.aws.amazon.com/streams/latest/dev/getting-started-with-sse.html) .

For more information about setting up user access logging, see [Set up user access logging](https://docs.aws.amazon.com/workspaces-web/latest/adminguide/user-logging.html) .

CfnUserAccessLoggingSettings

kinesisStreamArn

The tags to add to the user access logging settings resource.

A tag is a key-value pair.

This resource specifies user settings that can be associated with a web portal.

Once associated with a web portal, user settings control how users can transfer data between a streaming session and the their local devices.

CfnUserSettings

Specifies whether the user can copy text from the streaming session to the local device.

copyAllowed

Specifies whether the user can download files from the streaming session to the local device.

downloadAllowed

Specifies whether the user can paste text from the local device to the streaming session.

pasteAllowed

Specifies whether the user can print to the local device.

printAllowed

Specifies whether the user can upload files from the local device to the streaming session.

uploadAllowed

The additional encryption context of the user settings.

The branding configuration that customizes the appearance of the web portal for end users.

This includes a custom logo, favicon, wallpaper, localized strings, color theme, and an optional terms of service.

brandingConfiguration

The configuration that specifies which cookies should be synchronized from the end user's local browser to the remote browser.

cookieSynchronizationConfiguration

The customer managed key used to encrypt sensitive information in the user settings.

Specifies whether the user can use deep links that open automatically when connecting to a session.

deepLinkAllowed

The amount of time that a streaming session remains active after users disconnect.

disconnectTimeoutInMinutes

The amount of time that users can be idle (inactive) before they are disconnected from their streaming session and the disconnect timeout interval begins.

idleDisconnectTimeoutInMinutes

The tags to add to the user settings resource.

A tag is a key-value pair.

The configuration of the toolbar.

This allows administrators to select the toolbar type and visual mode, set maximum display resolution for sessions, and choose which items are visible to end users during their sessions. If administrators do not modify these settings, end users retain control over their toolbar preferences.

toolbarConfiguration

Specifies whether the user can use WebAuthn redirection for passwordless login to websites within the streaming session.

AWS workspacesweb

L1 Constructs10