A company plans to replace desktop PCs with Amazon WorkSpaces accessed via thin clients. The desktops access applications that handle clinical-trial data, and corporate policy requires that application access be restricted to the company branch office locations only. The company anticipates adding another branch office within 6 months. Which solution meets these requirements with the MOST operational efficiency?

Creating an IP access control group within Amazon WorkSpaces and associating it with the directory is the most operationally efficient solution. This built-in WorkSpaces feature directly restricts access to specified public IP addresses, ensuring that users can only connect from approved branch office locations. When a new branch office is added, you simply update the existing IP access control group with the new public IP address, which is a straightforward administrative task. Using AWS Firewall Manager with a web ACL is not directly applicable here as WorkSpaces access control is managed within the WorkSpaces service itself, not typically through WAF. AWS Certificate Manager (ACM) for trusted device certificates adds a layer of device-level authentication but doesn't inherently restrict network access based on IP, and managing certificates on thin clients can be complex. Building a custom WorkSpace image with Windows Firewall rules is less operationally efficient because it requires managing and updating custom images, which is more complex than updating an IP access control group, and the firewall rules would need to be maintained on each WorkSpace instance.