Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsManaging Chrome on AWS depends on which service runs it. Amazon WorkSpaces Secure Browser applies browser policies to portal sessions and can push changes to active sessions in real time. Amazon WorkSpaces Applications runs Chrome from an image or an Elastic-fleet app block that you manage; policy changes require an image update and redeployment. That difference determines how you author policies, audit activity, roll out changes, and plan a migration.
As of October 4, 2026, AWS documentation says WorkSpaces Secure Browser will stop accepting new customers on October 29, 2026, while existing customers can continue using it. New deployments should verify current availability and consider the Applications migration path before committing to an architecture.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
New Advanced Chrome Device Management: Chrome Enterprise | $15.24 | Buy on Amazon |
| 2 |
|
Burning Chrome: Brilliant Cyberpunk Science Fiction Short Stories by Master Author William Gibson | $11.17 | Buy on Amazon |
| 3 |
|
Chrome | $14.99 | Buy on Amazon |
| 4 |
|
Muscle & Chrome: Classic American Cars | $12.00 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Choose the AWS operating model first
| Operational question | WorkSpaces Secure Browser | WorkSpaces Applications with Chrome |
|---|---|---|
| Where Chrome runs | In browser sessions managed by a Secure Browser portal. | In a self-managed Chrome image for Always-On or On-Demand fleets, or in an app block used by an Elastic fleet. |
| Where policy is managed | In the portal’s browser policy settings, using visual controls, JSON editing, or JSON file upload. AWS documents support for more than 300 Chrome policies. AWS policy documentation | In the Chrome image or app block and its deployment process. Treat policy edits as image-management work, not as live portal policy changes. AWS migration guidance |
| How policy changes reach users | AWS says policy changes are pushed to active sessions in real time. | Update the image, validate it, and redeploy it to the relevant fleet. |
| Audit surfaces | AWS describes a unified audit stream. | Session events such as connections and disconnections go to CloudWatch; browser events are reported separately through Google Admin console when prerequisites are met. |
| Who maintains Chrome | AWS manages the portal session environment and its enforced baseline. | Your team maintains the Chrome image or Elastic-fleet app block and plans its releases. |
The right choice depends on whether you need a portal-managed browser session or a streamed application whose image and release cycle you control. The services differ in audit and filtering dependencies as well as policy rollout; those are not interchangeable implementation details.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do I manage Chrome policies in AWS WorkSpaces Secure Browser?
Author the customer policy for the right platform
Use the Secure Browser portal’s policy controls to set supported options visually, edit policy JSON, or upload a JSON file. AWS’s custom-policy tutorial recommends choosing Linux and the latest stable Chrome version in the Chrome Enterprise policy list when gathering policy settings. Confirm that each setting applies to Linux and to the Chrome version actually deployed; the policy list and browser versions can change. The tutorial’s examples include managed bookmarks, startup pages, extension allow/block rules, history deletion, and incognito restrictions. Read AWS’s custom browser policy tutorial.
#1 Best Overall
- Identify the portal and the policy behavior you want to control, such as startup pages, extension access, or incognito use.
- Check the Chrome policy definition for the relevant platform and version, then create or update the JSON or visual setting in the portal.
- Apply the change and verify the effective state inside a remote session at
chrome://policy. - Test the user-facing behavior as well as the policy status. A policy can be present yet not produce the expected result if the feature needs a restart or a service baseline takes precedence.
Interpret the effective policy, not just the uploaded file
The customer JSON is not the complete policy state. AWS applies baseline settings, including download-directory handling and blocked URL patterns; some baseline policies cannot be edited or overwritten. If the browser behaves differently from the JSON you uploaded, inspect chrome://policy in the remote session and compare the effective entries with your intended configuration. AWS documents the baseline and which settings can be edited separately. Review the Secure Browser baseline policy.
How do I deploy Chrome on Amazon WorkSpaces Applications?
WorkSpaces Applications uses a self-managed Chrome image or, for an Elastic fleet, an app block containing Chrome. Unlike portal-managed Secure Browser policy updates, Applications changes require you to update the image or app block and redeploy it. Plan this as a controlled release so a policy change is validated before it reaches the user fleet.
- Make the Chrome or policy change in a test image or app block.
- Validate startup, sign-in, required extensions, managed settings, and the user workflows affected by the change.
- Promote the validated artifact and redeploy it to the intended fleet. Keep the prior known-good image available according to your rollback process.
- Confirm the resulting browser policy and user experience in a streamed session, then monitor the applicable AWS and browser reporting channels.
For Elastic fleets, AWS describes instances as AWS-managed and gives an approximately one-minute startup time as guidance, not a service-level guarantee. Billing is based on session duration; verify current fleet documentation and pricing before estimating costs. See AWS’s migration and Elastic-fleet guidance.
Rank #2
Audit, identity, content filtering, and DLP are separate workstreams
Browser-event reporting
For browser-event reporting through Google Admin console with WorkSpaces Applications, AWS specifies two prerequisites: a Chrome Enterprise subscription and enrollment in Chrome Browser Cloud Management. This browser-level reporting is distinct from AWS session events. Applications session events, including connections and disconnections, are sent to CloudWatch; browser events are reported separately through Google Admin console when the prerequisites are satisfied. Secure Browser’s unified audit stream is a different operational model, so plan how the two sources will be connected if your audit process needs a comparable view. AWS documents the reporting distinction.
Content filtering and inline redaction
Do not assume Chrome policy JSON alone supplies content-category filtering or inline data redaction. AWS says content-category filtering requires Route 53 DNS Firewall or a third-party DLP extension or proxy. Inline redaction requires a third-party DLP extension. Choose the control that matches the data path and threat model, then validate how it works in the selected AWS operating model.
Identity and session controls
For a migration to a self-managed Chrome image, document identity-provider extensions used for SSO, DLP rules, and session or control policies separately from Chrome policy JSON. AWS specifically recommends exporting each portal’s browser policy JSON and separately documenting SSO integration, DLP rules, and session/control policies; the JSON does not capture every operational dependency. Use AWS’s migration guidance as a checklist.
Rank #3
Why are my Chrome policies not applying in WorkSpaces Secure Browser?
- The uploaded JSON does not match the effective state. Check
chrome://policyin the remote browser. AWS baseline settings may add policies or prevent editing or overriding some values. Compare effective entries, not only the uploaded file. See the baseline policy details. - The policy targets the wrong platform or Chrome release. Recheck the policy definition for Linux and the deployed Chrome version. AWS recommends selecting Linux and the latest stable Chrome version when collecting policy settings for Secure Browser in its custom-policy tutorial.
- The browser feature has not refreshed. Confirm the policy’s status and value in
chrome://policy, then restart the browser when that feature requires a restart. - WebAuthn redirection is not working. AWS says to add the region-specific WorkSpaces Secure Browser content origin to the local browser’s
WebAuthenticationRemoteDesktopAllowedOriginspolicy. A local browser restart may be required. Follow the AWS local-browser WebAuthn instructions; do not substitute a guessed origin. - A change was made to an Applications image but users still see the old behavior. Confirm that the updated image or app block was redeployed to the fleet and that the test session is using the intended release. Applications does not use Secure Browser’s real-time portal policy propagation.
What replaces WorkSpaces Secure Browser for new AWS customers?
AWS identifies WorkSpaces Applications with a self-managed Chrome image as a migration option. As of October 4, 2026, AWS states that WorkSpaces Secure Browser will stop accepting new customers on October 29, 2026; existing customers can continue using it. Because this is a time-sensitive service-availability statement, confirm the current AWS notice before making a deployment or procurement decision. Check the current AWS availability notice and migration guidance.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A migration plan should cover more than copying policy JSON. Export each portal’s policy, inventory SSO integration, DLP and session controls, decide how Chrome images or Elastic app blocks will be built and released, and establish the separate reporting paths needed for AWS session events and Chrome browser events. If browser-event reporting is required in Applications, include Chrome Enterprise subscription and Chrome Browser Cloud Management enrollment in the design.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Endpoint and fleet constraints to check
WorkSpaces Applications supports the three most recent major versions of its supported web browsers, according to AWS’s requirements documentation observed October 4, 2026. AWS lists Chrome or Firefox as required for drawing-tablet support and Chrome or Edge for webcam redirection. Verify current requirements for your client and endpoint before standardizing a browser, because these compatibility details can affect the user’s local connection experience even when Chrome runs remotely. See current WorkSpaces Applications browser requirements.
Rank #4
AWS describes both image-based Always-On or On-Demand fleets and Elastic fleets that use an app block containing Chrome. Elastic instances are AWS-managed, and the approximately one-minute startup guidance and session-duration billing should not be treated as a guarantee or a complete cost comparison. Check current fleet documentation, pricing, expected session patterns, and image-maintenance needs before choosing a model. Review AWS fleet migration information.
Or skip the browser setup
If the task is generating website screenshots rather than administering a Chrome fleet, ScreenshotNeo is a website screenshot API and MCP server. A single request can return a screenshot or PDF without setting up a browser session in your AWS environment. Cookie and consent banners are accepted and removed before capture, along with supported newsletter popups and chat widgets; each cleanup step can be disabled. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers report the page verdict and billing status. AI agents can use its MCP server tools, including take_screenshot, get_page_info, and capture_pdf.
Example cURL request (replace the URL and API key):
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for request options. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 screenshots. Sign up free for 1,000 screenshots a month, with no card required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
