WorkDocs

WorkDocs is built on a managed storage backend with per-user provisioning through a directory service. Each WorkDocs site is associated with an AWS directory (AWS Managed AD, Simple AD, or AD Connector), and users log in using their directory credentials.

WorkDocs stores documents in S3 on the backend, but users never interact with S3 directly. The service handles encryption, indexing, and versioning. Content is encrypted at rest using AES-256 and in transit using TLS.

Users can be provisioned manually through the WorkDocs console/API, or automatically via AD group membership if using Managed AD. There are three user roles:

# Add a user to a WorkDocs site
aws workdocs create-user \
  --organization-id d-9067abc123 \
  --username jsmith \
  --given-name John \
  --surname Smith \
  --password "TempP@ss123!" \
  --storage-rule StorageAllocatedInBytes=1099511627776

# List users in a WorkDocs site
aws workdocs describe-users \
  --organization-id d-9067abc123 \
  --query "Users[*].{User:Username,Status:RecycleBinFolderId}"

# Deactivate a user (retains their content)
aws workdocs deactivate-user \
  --user-id abc123-def456

WorkDocs supports granular sharing at the folder and document level. Sharing can be internal (with directory users) or external (via share links).

Permission levels for shares are: Viewer (read only), Contributor (upload new versions), Co-Owner (change permissions). These apply per-document and per-folder. Folder permissions propagate to child documents by default.

The feedback workflow lets reviewers annotate PDFs, images, and other supported file types with comments and annotations tied to specific pages or areas. This creates a structured review record without modifying the source document.

WorkDocs Drive is a desktop application for Windows and macOS that mounts WorkDocs storage as a local drive. Unlike the sync client, WorkDocs Drive streams files on demand rather than downloading everything - it shows all files in Explorer/Finder but only downloads content when you open it.

WorkDocs also integrates with Microsoft Office via a companion app that lets users check out and edit Office documents directly from WorkDocs without downloading and re-uploading. The checkout prevents concurrent edits by locking the document.

WorkDocs pricing is simple: you pay per user per month, and each user includes a storage allocation. There is no charge for data transfer between WorkDocs and other AWS services in the same region.

# Check storage usage for a WorkDocs site (admin API)
aws workdocs get-current-user \
  --authentication-token $AUTH_TOKEN

# The StorageRule field in user details shows allocated vs used:
# "StorageRule": {
#   "StorageAllocatedInBytes": 1099511627776,
#   "StorageType": "QUOTA"
# }

WorkDocs provides comprehensive activity logging for compliance and security auditing. All user actions - uploads, downloads, shares, deletes, permission changes - are recorded.

For compliance scenarios, WorkDocs can be used as a secure document repository because it maintains full version history indefinitely (until explicitly deleted), encrypts all content, and logs all access. The 60-day recycle bin provides a recovery window for accidental deletions.