AppStream 2.0

AppStream runs application instances on EC2 instances called streaming instances. Users connect via a web browser using the NICE DCV protocol (or HTML5 fallback). Each user session runs inside a Windows Server or Amazon Linux 2 environment where the application is already installed on a custom image.

The flow is: user authenticates (SAML 2.0 or API) -> AppStream selects an available fleet instance -> user sees the application catalog -> application launches on the instance -> display is streamed via NICE DCV to the browser.

AppStream 2.0 offers three fleet types that trade off between cost, session start latency, and management overhead.

Elastic fleets are the newest option and require applications to be packaged as AppBlocks (VHD files stored in S3). The fleet scales to zero between sessions and pulls from a managed warm pool, providing lower idle cost than Always-On with faster starts than On-Demand.

The image building process involves launching an Image Builder instance, installing your applications, running the Image Assistant to optimize the image, and then creating a snapshot as an AppStream image.

# Create an Image Builder instance via CLI
aws appstream create-image-builder \
  --name my-image-builder \
  --instance-type stream.standard.medium \
  --image-name AppStream-WinServer2019-10-05-2023 \
  --vpc-config SubnetIds=subnet-abc123,SecurityGroupIds=sg-xyz789

# List available images
aws appstream describe-images \
  --type PRIVATE

# Create image from Image Builder (after using Image Assistant on the instance)
aws appstream create-image-builder-streaming-url \
  --name my-image-builder \
  --validity 3600

Best practices for image building include: installing only the software needed (smaller images start faster), using the Image Optimization step in Image Assistant (pre-launches apps for faster first-launch), and keeping images updated monthly for security patches.

AppStream 2.0 supports three authentication methods for delivering sessions to users.

# Generate a streaming URL for programmatic access (SaaS embedding)
aws appstream create-streaming-url \
  --stack-name my-stack \
  --fleet-name my-fleet \
  --user-id user@example.com \
  --application-id MyApp \
  --validity 300

# Output:
# {
#   "StreamingURL": "https://appstream2.us-east-1.aws.amazon.com/authenticate?parameters=...",
#   "Expires": "2024-01-15T14:30:00Z"
# }

By default, AppStream sessions are stateless. To give users persistent storage, you configure one or more storage connectors on the stack.

Home folders are stored in an S3 bucket that AppStream creates in your account (named appstream2-36fb080bb8-us-east-1-ACCOUNTID). Each user gets a prefix under appstream/home/USERNAME/. You own this data and can apply lifecycle rules, replication, or access policies.

AppStream and WorkSpaces are both virtual desktop/application services but serve different use cases. This is a common interview comparison.

A key architectural difference: AppStream can run multiple user sessions on a single instance (multi-session fleets), reducing cost for light users. WorkSpaces is always dedicated one-to-one.