What does the AWS WorkSpaces agent access sample use?

The current AWS sample uses the Strands Agents SDK with Claude Computer Use through Amazon Bedrock and connects to the managed WorkSpaces Applications MCP service.

Does the sample deployment establish a production security baseline?

No. It is implementation evidence. The repository itself warns that its AgentCore example is single-principal only unless additional cross-invoker isolation is built.

Do MCP and model requests use the same AWS permission?

No. The sample supports separate profiles for SigV4 signing to the WorkSpaces MCP endpoint and for Bedrock model invocation. Scope and audit them separately.

AI Agent - Aug 12, 2026

Set Up WorkSpaces Agent Access with Strands and Claude

Quick answer

AWS’s official sample repository is the fastest current implementation reference for connecting Strands Agents, Claude Computer Use, Amazon Bedrock, and the managed WorkSpaces Applications MCP service. It can deploy a VPC, fleet, agent-enabled stack, create a streaming URL, and run demonstration agents.

Use it in a sandbox account as a learning fixture, not as a production baseline. Review every setup script and generated resource, pin revision 94b0e37578ccaca46837c3e9a9c21997c94d746a, replace broad credentials, and begin with a reversible demo.

Prerequisite map

The current README expects:

an AWS account permitted to create WorkSpaces Applications fleets and stacks and invoke Amazon Bedrock;
AWS CLI v2 and verified AWS credentials;
Python 3.10 or newer;
Bash on macOS/Linux or Git Bash/WSL support for the Windows deploy path;
a supported Region where both agent access and the selected model are available.

The documented setup installs dependencies, deploys VPC and WorkSpaces resources, waits for the fleet, generates a streaming URL, and runs a demo. Read the scripts before execution because they create billable and security-relevant infrastructure.

Separate the credentials

The sample exposes distinct --mcp-profile and --llm-profile options. The MCP profile signs requests to the regional agentaccess-mcp endpoint; the model profile invokes Bedrock. The MCP signing region must match the fleet region, while model access follows the selected Bedrock model and Region.

Use separate roles when the permissions or operators differ. Keep streaming URLs, SAML assertions, model credentials, screenshot bucket access, and application logins out of source control and ordinary logs. Verify identity with aws sts get-caller-identity, but remember that a valid caller is not proof of least privilege.

Start with the minimal path

The repository includes a self-contained quickstart alongside larger demos. A safe evaluation sequence is:

create a dedicated test account or tightly bounded environment;
inspect and pin the repository and dependency lock inputs;
deploy one Windows test image and an On-Demand fleet with minimum capacity;
enable only the required computer-input or computer-vision capability;
generate a short-lived streaming URL for one named test user;
run a read-only navigation or extraction task;
inspect CloudTrail data events, CloudWatch metrics, local logs, screenshots, and AWS billing;
clean up and confirm that the fleet, stack, network, storage, credentials, and logs follow the intended retention policy.

Do not begin with the prescription-refill narrative from the launch post or another regulated, consequential workflow.

Understand sample-specific behavior

The current sample documents retry handling, screenshot pruning, multiple demo agents, MCP tool forwarding, domain-joined SAML, and optional AgentCore deployment. Each expands scope.

Screenshot pruning removes older images from model context by default; it is not the same as deleting local screenshots or S3 audit images. Connection retries can recover initialization but must not repeat a committed application action. Forwarded tools bypass some screen interaction and need their own authorization. Domain join changes session authentication but not every application’s access logic.

The AgentCore appendix carries a particularly important warning: the sample handler accepts a streaming URL directly, so anyone allowed to invoke that runtime can drive any session the execution role can reach. The repository calls this a single-principal deployment only unless a signed-grant and ownership flow is added.

Acceptance tests before adaptation

Expired, replayed, wrong-region, and cross-user streaming URLs.
Missing, revoked, and overbroad MCP and model credentials.
UI scaling, window movement, dialogs, and stale screenshots.
Model timeout before and after a desktop action.
Human stop, agent disconnect, session expiry, and cleanup.
Duplicate prevention and system-of-record reconciliation.
Screenshot, local log, CloudTrail, and CloudWatch data exposure.
Full teardown and a fresh reproducible deploy from pinned inputs.

Use the MCP and audit guide for connection controls, the vision and screenshot guide for evidence handling, and the readiness checklist for release approval.

Frequently asked questions

What framework and model does the sample use?

It uses Strands Agents and Claude Computer Use through Amazon Bedrock.

Is it production-ready code?

Do not infer that. It is a sample, and some paths explicitly carry single-principal or Preview boundaries.

Can MCP and model permissions be separated?

Yes. The sample exposes separate AWS profiles; use that separation to enforce least privilege.

Official sources

Source check: August 12, 2026; sample revision 94b0e37578ccaca46837c3e9a9c21997c94d746a. Recheck prerequisites, scripts, packages, default model, Region, warnings, and cleanup before running it.