AWS WorkSpaces deployment (Beta)

Deploy the same signed AgentKeeper RPM to persistent WorkSpaces Personal and pooled or ephemeral sessions. Golden images contain the package and service assets only. Enrollment happens when a concrete workstation or session starts, keeping tokens, device credentials, workstation identity, and customer evidence out of the image.

Image bake

sudo dnf install -y ./agentkeeper-runtime-<version>-<release>.ak.x86_64.rpm
sudo agentkeeper prepare-image --json
sudo test ! -f /var/lib/agentkeeper/State/credential.json
sudo test ! -f /var/lib/agentkeeper/State/device-key.json
sudo test ! -f /etc/agentkeeper/config.json
sudo test ! -d /var/lib/agentkeeper/State/surfaces

If prepare-image reports existing runtime state, review the returned paths. Use --clean only on the image template, never on a live enrolled workstation.

Persistent WorkSpaces Personal

At first boot, retrieve the short-lived enrollment token from customer automation, resolve the SSSD user with getent passwd, and enroll with --deployment-mode persistent. The deployment mode, deployment ID, and any explicit targets must match the token's signed scope; the runtime persists the server-verified values. Re-enrollment rotates the device credential while reusing the stable hardware/workstation identity. Because a WorkSpaces rebuild replaces the root volume but restores the user volume, package and user-hook reconciliation must be rerun and is designed to be idempotent.

After rebuild:

sudo dnf install -y agentkeeper-runtime
printf '%s' "$AK_ENROLLMENT_TOKEN" | sudo agentkeeper enroll-enterprise \
  --token-stdin --api-url https://www.agentkeeper.dev --org-id YOUR_ORG_ID \
  --deployment-id YOUR_DEPLOYMENT_ID --target-user 'DOMAIN\\username' \
  --targets all --deployment-mode persistent
sudo agentkeeper reconcile --source rebuild --json

WorkSpaces Pools / ephemeral sessions

Session-start automation obtains a one-time token, enrolls with --deployment-mode ephemeral, and scopes the concrete user. The reusable image remains credential-free. At shutdown, the package deregisters the ephemeral device and removes local enrollment identity; persistent devices are left unchanged. Each signed heartbeat renews the server lease, and abandoned ephemeral records expire automatically when a shutdown hook cannot run.

Canary and expansion

Start with 2–5 workstations using the same image, network controls, identity format, and AI-agent mix as the target fleet. Expand after confirming stable workstation identity, fresh reconciliation, expected hook coverage, and acceptable action-time latency through a normal working cycle. An optional IDE that is not installed is reported as not_seen and does not make the package unhealthy.

Keep the distribution image ID, package NEVRA, source SHA, catalog and Gateway versions, WorkSpaces lifecycle, SSSD user format, proxy/CA and SELinux/FIPS posture, surface evidence, rebuild result, and rollback result with the deployment change record.

AWS references: Linux WorkSpaces management and WorkSpaces rebuild behavior.